?? showpeunit.pas
字號:
Cells[6,i]:=DWord2Hex(PEHeader.Objects[i].PointerToRelocations);
Cells[7,i]:=DWord2Hex(PEHeader.Objects[i].PointerToLinenumbers);
Cells[8,i]:=Word2Hex(PEHeader.Objects[i].NumberOfRelocations);
Cells[9,i]:=Word2Hex(PEHeader.Objects[i].NumberOfLinenumbers);
End;
ShowPEData;
{#end of visuzlization}
end;
procedure TPEIForm.FormCreate(Sender: TObject);
begin
With ObjectSGrid Do
Begin
Cells[0,0]:='object name';
Cells[1,0]:='RVA';
Cells[2,0]:='physical offset';
Cells[3,0]:='physical size';
Cells[4,0]:='virtual size';
Cells[5,0]:='flags';
Cells[6,0]:='PtrToRelocs';
Cells[7,0]:='PtrToLinenums';
Cells[8,0]:='NumOfRelocs';
Cells[9,0]:='NumOfLinenums';
End;
InitLabels;
OldRow:=-1;
end;
procedure TPEIForm.InitLabels;
begin
//
ExpPhOffsetLbl.Caption:='';
Exp1Lbl.Caption:='';
Exp2Lbl.Caption:='';
Exp3Lbl.Caption:='';
Exp4Lbl.Caption:='';
Exp5Lbl.Caption:='';
Exp6Lbl.Caption:='';
Exp7Lbl.Caption:='';
Exp8Lbl.Caption:='';
Exp9Lbl.Caption:='';
ExportLV.Items.Clear;
PhysImLbl.Caption:='';
DLLNumLbl.Caption:='';
ProcNumLbl.Caption:='';
DLLMemo.Clear;
ImportList.Items.Clear;
ImportTree.Items.Clear;
end;
procedure TPEIForm.ShowPEData;
begin
With PEHeader Do
Begin
{PE HEADER}
SignLbl.Caption:=Signature;
CPULbl.Caption:=CPU;
ONumLbl.Caption:=IntToStr(ObjectNum);
TSLbl.Caption:=IntToHex(TimeStamp,8);
SymTblOffsetLbl.Caption:=IntToHex(SymTblOffset,8)+'h';
SymNumLbl.Caption:=IntToStr(SymNum);
NTHDRLbl.Caption:=Word2Hex(NT_HDR_SIZE)+'h ('+IntToStr(NT_HDR_SIZE)+')';
SetOEnable(False);
Try
O1.Checked:=FLAGS[1];
O2.Checked:=FLAGS[2];
O4.Checked:=FLAGS[3];
O8.Checked:=FLAGS[4];
O10.Checked:=FLAGS[5];
O20.Checked:=FLAGS[6];
O40.Checked:=FLAGS[7];
O80.Checked:=FLAGS[8];
O100.Checked:=FLAGS[9];
O200.Checked:=FLAGS[10];
O400.Checked:=FLAGS[11];
O1000.Checked:=FLAGS[13];
O2000.Checked:=FLAGS[14];
O4000.Checked:=FLAGS[15];
O8000.Checked:=FLAGS[16];
Finally
SetOEnable(True);
End;
End;
end;
procedure TPEIForm.ObjectSGridSelectCell(Sender: TObject; ACol,
ARow: Integer; var CanSelect: Boolean);
begin
If ARow>PEHeader.ObjectNum Then Exit;
SaveOldRowChanges;
SectionDataLbl.Caption:=dword2hex(PEHeader.Objects[ARow].InfoAddress);
LoadSectionInformationForEditing(ARow);
If ACol<>5 Then Exit;
If ObjectSGrid.Cells[0,ARow]='' Then Exit;
end;
procedure TPEIForm.LoadSectionInformationForEditing(ARow: Integer);
var s : String;
begin
SesIDLbl.Caption:=IntToStr(ARow);
SectionNameCombo.Text:=ObjectSGrid.Cells[0,ARow];
RVAEdit.Text:=ObjectSGrid.Cells[1,ARow];
PhysOffsetEdit.Text:=ObjectSGrid.Cells[2,ARow];
PhysSizeEdit.Text:=ObjectSGrid.Cells[3,ARow];
VirtSizeEdit.Text:=ObjectSGrid.Cells[4,ARow];
FlagsEdit.Text:=ObjectSGrid.Cells[5,ARow];
s:=ObjectSGrid.Cells[0,ARow];
If (s='CODE') or (s='.text') then s:='Excutable Code';
If (s='DATA') or (s='.data') then s:='Data';
If s='.idata' then s:='Imports';
If s='.edata' then s:='Exports';
If (s='.rsrc') or (s='.rdata') then s:='Resources';
If s='.reloc' then s:='Fix-Up Table';
If s='.tls' then s:='Thread Local Storage';
If s='.pdata' then s:='Exceptions table';
If s='.debug' then s:='Debug Information';
SesDescriptionLbl.Caption:=s;
OldRow:=ARow;
end;
procedure TPEIForm.Button6Click(Sender: TObject);
function CompareDLLNames(s1,s2 : String) : Boolean;
var i, n : Integer;
begin
Result:=False;
n:=Length(s1);
i:=Length(s2);
If i<n Then n:=i;
i:=0;
Repeat
Inc(i);
Until (i=n) or (s1[i]<>s2[i]);
If s1[i]=s2[i] Then Result:=True;
end;
var lImpOffset, lImpSize : LongInt;
i,j,k : Integer;
TmpList,TTmpList : TStringList;
inst : TListItem;
tinst : TTreeNode;
CurrDLL : String;
begin
With DeDeMainForm Do
Begin
i:=PEHeader.GetSectionIndex('.idata');
If i=-1 Then i:=PEHeader.GetSectionIndexByRVA(PEHeader.IMPORT_TABLE_RVA);
If i=-1 Then Raise Exception.Create(err_has_no_import);
lImpOffset:=PEHeader.Objects[i].PHYSICAL_OFFSET;
// lImpSize:=PEHeader.Objects[i].PHYSICAL_SIZE;
//lImpOffset:=PEHeader.Objects[PEHeader.GetSectionIndex('.idata')].PHYSICAL_OFFSET;
PhysImLbl.Caption:=DWord2Hex(lImpOffset);
PEImportData.FileName:=FileEdit.FileName;
TmpList:=TStringList.Create;
TTmpList:=TStringList.Create;
Try
//This routine does everything
PEImportData.CollectInfo(lImpOffset, PEHeader.Objects[i].RVA, TmpList);
DLLNumLbl.Caption:=IntToStr(PEImportData.DLLCount);
ProcNumLbl.Caption:=IntToStr(PEImportData.ProcCount);
// Processing Data For ImportListView
DLLMemo.Clear;
ImportList.Items.Clear;
For i:=0 To TmpList.Count-1 Do
Begin
If Copy(TmpList[i],1,1)<>' ' Then
Begin
If DLLMemo.Items.IndexOf(TmpList[i])=-1
Then DLLMemo.Items.Add(TmpList[i]);
CurrDLL:=TmpList[i];
End
Else Begin
TTmpList.Clear;
TTmpList.CommaText:=Copy(TmpList[i],2,Length(TmpList[i])-1);
inst:=ImportList.Items.Add;
inst.Caption:=CurrDLL;
inst.Subitems.Add(TTmpList[0]);
inst.Subitems.Add(TTmpList[1]);
inst.Subitems.Add(TTmpList[2]);
End;
End;
ImportList.Update;
//Processing Data For ImportTreeView
ImportTree.Items.Clear;
ImportTree.Update;
ImportTree.Items.BeginUpdate;
For i:=0 To DLLMemo.Items.Count-1 Do
Begin
// Adds dll name as root node
tinst:=ImportTree.Items.AddChild(nil,DLLMemo.Items[i]);
// For j through all imports
For j:=0 To ImportList.Items.Count-1 Do
Begin
k:=0;
CurrDLL:='';
Repeat Inc(k);
Until (ImportList.Items[j].Caption[k]=' ')
or (k=Length(ImportList.Items[j].Caption[k]));
CurrDLL:=CurrDLL+Copy(ImportList.Items[j].Caption,1,k-2);
// If DLLName of Current Item in ImportsList is equal to
// Current DLLName
If CompareDLLNames(String(ImportList.Items[j].Caption),DLLMemo.Items[i]) Then
Begin
CurrDLL:=ImportList.Items[j].Subitems[0];
ImportTree.Items.AddChild(tinst,CurrDLL);
End; {If CompareDLLNames}
End; {For j}
End; {For i}
Finally
ImportTree.Items.EndUpdate;
TmpList.Free;
TTmpList.Free;
End;
End;
end;
procedure TPEIForm.Button8Click(Sender: TObject);
var lExpOffset, lExpSize : LongInt;
i : Integer;
s1,s2,s3 : String;
inst : TListItem;
begin
With DeDeMainForm Do
Begin
i:=PEHeader.GetSectionIndex('.edata');
If i=-1 Then Raise Exception.Create(err_has_no_export);
lExpOffset:=PEHeader.Objects[i].PHYSICAL_OFFSET;
// lExpSize:=PEHeader.Objects[i].PHYSICAL_SIZE;
ExpPhOffsetLbl.Caption:=DWORD2Hex(lExpOffset)+'h';
ExportLV.Items.Clear;
PEExports.FileName:=FileEdit.FileName;
Try
// This routine does everything
PEExports.Process(lExpOffset,PEHeader.Objects[i].RVA);
Except
ShowMessage('Error');
End;
Exp1Lbl.Caption:=PEExports.DATE_TIME_STAMP;
Exp2Lbl.Caption:=PEExports.VERSION;
Exp3Lbl.Caption:=PEExports.Name_RVA;
Exp4Lbl.Caption:=IntToStr(PEExports.Ordinal_Base);
Exp5Lbl.Caption:=IntToStr(PEExports.Address_Table_Entries);
Exp6Lbl.Caption:=IntToStr(PEExports.Number_of_Name_Pointers);
Exp7Lbl.Caption:=PEExports.Export_Address_Table_RVA;
Exp8Lbl.Caption:=PEExports.Name_Pointer_RVA;
Exp9Lbl.Caption:=PEExports.Ordinal_Table_RVA;
For i:=1 To PEExports.Address_Table_Entries Do
Begin
s1:=IntToStr(PEExports.FUNC_DATA[i].Ordinal);
s2:=PEExports.FUNC_DATA[i].Offset;
s3:=PEExports.FUNC_DATA[i].Name;
While Length(s1)<3 Do s1:=' '+s1;
While Length(s2)<16 Do s2:=s2+' ';
While Length(s3)<16 Do s3:=s3+' ';
inst:=ExportLV.Items.Add;
inst.Caption:=s3;
inst.Subitems.Add(s1);
inst.Subitems.Add(s2);
// ExportsMemo.Lines.Add(Format('%s Ord: %s RVA: %s ',[s3,s1,s2]));
End;
End;
end;
procedure TPEIForm.Button1Click(Sender: TObject);
Var ObjectObj : TPEObject;
ObjID, i : Integer;
sNewFile : String;
begin
SaveDlg.InitialDir:=ExtractFileDir(PEFile.sFileName);
SaveDlg.FileName:=PEFile.sFileName;
if not SaveDlg.Execute then exit;
// IF MessageDlg(wrn_change_file,
// mtConfirmation,[mbYes,mbNo],0)=mrNo Then Exit;
ObjectSGrid.Cells[1,OldRow]:=RVAEdit.Text;
ObjectSGrid.Cells[2,OldRow]:=PhysOffsetEdit.Text;
ObjectSGrid.Cells[3,OldRow]:=PhysSizeEdit.Text;
ObjectSGrid.Cells[4,OldRow]:=VirtSizeEdit.Text;
ObjectSGrid.Cells[5,OldRow]:=FlagsEdit.Text;
For i:=1 to PEHeader.ObjectNum do
begin
ObjID:=i;
ObjectObj.OBJECT_NAME:=ObjectSGrid.Cells[0,i];
ObjectObj.VIRTUAL_SIZE:=HEX2DWORD(ObjectSGrid.Cells[4,i]);
ObjectObj.RVA:=HEX2DWORD(ObjectSGrid.Cells[1,i]);
ObjectObj.PHYSICAL_OFFSET:=HEX2DWORD(ObjectSGrid.Cells[2,i]);
ObjectObj.PHYSICAL_SIZE:=HEX2DWORD(ObjectSGrid.Cells[3,i]);
ObjectObj.FLAGS:=HEX2DWORD(ObjectSGrid.Cells[5,i]);
ObjectObj.PointerToRelocations:=PEHeader.Objects[ObjID].PointerToRelocations;
ObjectObj.PointerToLinenumbers:=PEHeader.Objects[ObjID].PointerToLinenumbers;
ObjectObj.NumberOfRelocations:=PEHeader.Objects[ObjID].NumberOfRelocations;
ObjectObj.NumberOfLinenumbers:=PEHeader.Objects[ObjID].NumberOfLinenumbers;
ObjectObj.MakeBuffer;
PEFile.Seek(PEHeader.Objects[i].InfoAddress);
For ObjID:=1 To 40 Do PEFile.Write(ObjectObj.DATA[ObjID]);
end;
Try
PEFile.PEStream.SaveToFile(SaveDlg.FileName{FsFileName});
ShowMessage(msg_save_succ);
Except
on e: Exception do
ShowMessage(msg_save_not_succ+#13#10+e.Message);
End;
if Not bELF
then PEHeader.Dump(Self.PEFile)
else Raise Exception.Create('This is not PE file !');
ShowPEData;
FormShow(self);
end;
procedure TPEIForm.Button10Click(Sender: TObject);
var s, sec : String;
i : Integer;
begin
sec:='';
for i:=1 to PEHeader.ObjectNum do
begin
s:=GetDelphiVersion(PEFile)+' ';
if copy(s,1,1)='D'
then Case i Of
0,1 : sec:='60000020';
2,5 : sec:='C0000040';
3: sec:='40000040';
4,7 : sec:='C0000000';
6,8,9,10,11 : sec:='50000040';
End
else begin
s:=ObjectSGrid.Cells[0,i];
if (Pos('text',s)<>0) or (Pos('CODE',s)<>0) then sec:='E000020';
if (i=1) and (sec='') then s:='E000020';
end;
If sec<>'' Then ObjectSGrid.Cells[5,i]:=sec;
end;
end;
procedure TPEIForm.Button9Click(Sender: TObject);
begin
FlagsEditForm.FsFlags:=FlagsEdit.Text;
FlagsEditForm.SetSectionFlags;
FlagsEditForm.ShowModal;
FlagsEdit.Text:=FlagsEditForm.FsFlags;
end;
function TPEIForm.PrepareImports: TStringList;
var i : Integer;
s,s1 : String;
begin
FormShow(self);
Try
Button6Click(Self);
Except
End;
Result:=TStringList.Create;
For i:=0 To ImportList.Items.Count-1 Do
Begin
s:=ImportList.Items[i].Caption;
If Copy(s,Length(s),1)=#0 Then s:=Copy(s,1,Length(s)-1);
s1:=ImportList.Items[i].Subitems[0];
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -