frmmain.pas

你用过ExeScope吗？它是能够将Exe文件中的资源进行查看并修改的工具

{**************************************************************
*                                                             *
*  Copyright @2002-2003                                       *
*  Author: OuChengSong                                        *
*  Create Date:   2003-1-1                                    *
*                                                             *
*  Descript: 主窗体,提供PE文件的操作.                         *
*                                                             *
**************************************************************}

unit FrmMain;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, ActnCtrls, XPStyleActnCtrls, ActnList, ActnMan, ActnColorMaps,
  ToolWin, ActnMenus, XPMan, ImgList, StdActns, ExtActns, ExtCtrls,
  ComCtrls, Buttons, StdCtrls,Menus, jpeg, Grids,ValEdit,

  { 手工加入的单元 }
  ExeImage, peTypes,Math,ShellAPI,shlObj,ActiveX,FPSet,IniFiles;
{  se_controls, KsSkinForms, KsSkinEngine;}


type
  TMainForm = class(TForm)
    ActionMainMenuBar1: TActionMainMenuBar;
    ActionManager1: TActionManager;
    ActionToolBar1: TActionToolBar;
    ImageList1: TImageList;
    FileExit: TFileExit;
    EditCut: TEditCut;
    EditCopy: TEditCopy;
    EditPaste: TEditPaste;
    EditSelectAll: TEditSelectAll;
    EditDelete: TEditDelete;
    SearchFind: TSearchFind;
    SearchFindNext: TSearchFindNext;
    SearchReplace: TSearchReplace;
    FileClose: TAction;
    ProjOptions: TAction;
    ProjTestRun: TAction;
    ProjDialogPreview: TAction;
    HelpContent: TAction;
    HelpAbout: TAction;
    HelpIndex: TAction;
    ProjCompiler: TAction;
    ProjAnalyReport: TAction;
    FileSave: TAction;
    FileOpen: TAction;
    FileImport: TAction;
    FileExport: TAction;

    PnlTop: TPanel;
    PnlLeft: TPanel;
    PnlRight: TPanel;
    SplitterV: TSplitter;
    OpenDialog: TOpenDialog;
    SaveDialog: TSaveDialog;
    trvPEStructure: TTreeView;
    PnlLeftTop: TPanel;
    pnlRightTop: TPanel;
    nbExeRes: TNotebook;
    lvDetailRes: TListView;
    ImgPIC: TImage;
    lvBinaryRes: TListView;
    trvMenuRes: TTreeView;
    lvStringRes: TListView;
    ProjBinary: TAction;
    ScrollBoxImg: TScrollBox;
    ImgPICRes: TImage;
    Bevel1: TBevel;
    Image1: TImage;
    Panel1: TPanel;
    lbFileVersion: TLabel;
    lbProductVersion: TLabel;
    edFileVersion: TEdit;
    edProductVersion: TEdit;
    GroupBox1: TGroupBox;
    chkDebug: TCheckBox;
    chkPatched: TCheckBox;
    chkPrerelease: TCheckBox;
    chkInfoInferred: TCheckBox;
    chkPrivateBuild: TCheckBox;
    chkSpecialBuild: TCheckBox;
    lbOS: TLabel;
    edOS: TEdit;
    lbFileType: TLabel;
    edFileType: TEdit;
    lbLanguage: TLabel;
    cbLanguage: TComboBox;
    vleVersion: TValueListEditor;
    lbCodePage: TLabel;
    cbCodePage: TComboBox;
    lbLanguageID: TLabel;
    edTrans: TEdit;
    ActReOpen1: TAction;
    ActReOpen2: TAction;
    ActReOpen3: TAction;
    ActReOpen4: TAction;
    btnShowCtrl: TBitBtn;
    memText: TMemo;
    pnlBottom: TPanel;
    StatusBar: TStatusBar;
    pbLoadBinary: TProgressBar;
    PopupMenu1: TPopupMenu;
    nSaveBmp: TMenuItem;
    ImageList2: TImageList;
    procedure FormCreate(Sender: TObject);
    procedure FileOpenExecute(Sender: TObject);
    procedure FileCloseExecute(Sender: TObject);
    procedure FileImportExecute(Sender: TObject);
    procedure FileExportExecute(Sender: TObject);
    procedure SearchFindFindDialogShow(Sender: TObject);
    procedure SearchFindFindDialogFind(Sender: TObject);
    procedure SearchFindFindDialogClose(Sender: TObject);
    procedure SearchReplaceReplaceDialogShow(Sender: TObject);
    procedure ProjOptionsExecute(Sender: TObject);
    procedure ProjAnalyReportExecute(Sender: TObject);
    procedure ProjDialogPreviewExecute(Sender: TObject);
    procedure ProjTestRunExecute(Sender: TObject);
    procedure ProjCompilerExecute(Sender: TObject);
    procedure EditCutExecute(Sender: TObject);
    procedure EditCopyExecute(Sender: TObject);
    procedure EditPasteExecute(Sender: TObject);
    procedure EditDeleteExecute(Sender: TObject);
    procedure EditSelectAllExecute(Sender: TObject);
    procedure HelpContentExecute(Sender: TObject);
    procedure HelpIndexExecute(Sender: TObject);
    procedure HelpAboutExecute(Sender: TObject);
    procedure FileSaveExecute(Sender: TObject);
    procedure trvPEStructureChange(Sender: TObject; Node: TTreeNode);
    procedure ProjBinaryExecute(Sender: TObject);
    procedure ScrollBoxImgResize(Sender: TObject);
    procedure ActReOpen1Execute(Sender: TObject);
    procedure btnShowCtrlClick(Sender: TObject);
    procedure FormResize(Sender: TObject);
    procedure nSaveBmpClick(Sender: TObject);
  private
    { Private declarations }
    //支持文件的拖拉，与打开文件功能相同。
    procedure WMDropFiles(var Msg:TWMDropFiles); message WM_DROPFILES;

    procedure ActionInitState;
    procedure ActionOpenState;
    procedure DisplayPEStructure; //显示PE结构
    procedure DisplayPEHeader;    //头部
    procedure DisplayPEExport;    //导出
    procedure DisplayPEImport;    //导入
    procedure DisplayPEResource;
    procedure ClearPEContent;
    procedure LoadRootInfoForHeader(ANode: TTreeNode);
    procedure LoadRootInfoForResource(ANode: TTreeNode);
    procedure LoadLeafInfoForHeader(ANode: TTreeNode);
    procedure LoadLeafInfoForResource(ANode: TTreeNode);
    procedure LoadVisualInfoForResource(AOffset, ASize,IndexOffset: Integer; ResType,ResName: String);
    procedure LoadExportDirData(SelText:String);
    procedure LoadImportDirData(SelText:String;IndexOfName:WORD);

    { 显示位图,光标,图标,字串表,加速键,版本,对话框 }
    procedure ShowBitmap(AOffset, ASize: Integer);
    procedure ShowCursor(AOffset, ASize, HeaderOffset,NameID: Integer);
    procedure ShowIcon(AOffset, ASize, HeaderOffset,NameID: Integer);
    procedure ShowString(AOffset, ASize: Integer; ResName: String);
    procedure ShowAccelerator(AOffset,ASize:Integer);
    procedure ShowVersionInfo(AOffset,ASize:Integer);
    procedure ShowDialogBox(AOffset,ASize:Integer);
    procedure ShowMenuItem(AOffset,ASize:Integer;MenuText:String);
    procedure ShowToolItem(AOffset,ASize:Integer);
    procedure ShowTextContent(AOffset,ASize:Integer);
    procedure ShowDialogData(AOffset,ASize:Integer);
    procedure ShowPackageInfo(AOffset,ASize:Integer);    

    procedure LoadCoffHeadInfo;
    procedure LoadDosHeadInfo;
    procedure LoadOptionHeadInfo;
    procedure LoadSectionHeadInfo(AIndex: Word);
    procedure LoadBinaryInfo(AOffset,ACount:Integer);
    procedure LoadExeImage(AFileName: String);
    function GetShortcutTarget(ShortcutFilename: String): String;
    function GetResIndex(ResType,ResName:String):Integer;
  public
    { Public declarations }

  end;

var
  MainForm: TMainForm;
  CurExeImg: TExeImage;

  ResDataDir: Variant; //array of TResourceDataDir;
  ResIndex:  Integer;  //当前选择节点所在ResDataDir的位置.
  OldPageIndex: Word=0;  //保存上次的PageIndex;

  DlgStream: TMemoryStream;

implementation

//加入其它窗体单元
uses
  FrmAbout,FrmMenu,FrmDialog;

  //function RegisterServiceProcess(dwProcessId,dwType:LongInt):LongInt; stdcall; external advapi32 name 'RegisterServiceProcess';


resourcestring
  //对话框过滤器中的内容.
  SFileOpenFilter  = '运行文件(*.exe;*.dll;*.ocx)|*.exe;*.dll;*.ocx|PE资源文件(*.pes)|*.pes|所有文件(*.*)|*.*';
  SFileSaveFilter  = 'PE资源文件(*.pes)|*.pes';
  SResImportFilter = '';
  SResExportFilter = '';
  ProgName = 'PEView';
  Version = 'V1.0 Beta';

{$R *.dfm}


procedure TMainForm.FormCreate(Sender: TObject);
var
  peini:TIniFile;
  tmpFileName: String;
begin
  //RegisterServiceProcess(Application.Handle,0);
  Application.Title := ProgName;
  MainForm.Caption := Application.Title;
  pbLoadBinary.Visible := False;
  nbExeRes.PageIndex := 0;

  ActionInitState;

  ////需要重新配置重新打开的各个Caption，读自ini文件.
  ActReOpen1.Visible := False;
  ActReOpen2.Visible := False;
  ActReOpen3.Visible := False;
  ActReOpen4.Visible := False;
  tmpFileName := ExtractFilePath(Application.ExeName)+'peset.ini';
  if FileExists(tmpFileName) then
  begin
    peIni := TIniFile.Create(tmpFileName);
    try
      ActReOpen1.Caption := peini.ReadString('ReOpen','1','');
      ActReOpen2.Caption := peini.ReadString('ReOpen','2','');
      ActReOpen3.Caption := peini.ReadString('ReOpen','3','');
      ActReOpen4.Caption := peini.ReadString('ReOpen','4','');

      if ActReOpen1.Caption = '' then
         ActReOpen1.Visible := False
      else begin
         ActReOpen1.Caption := Format('&1 %s',[ActReOpen1.Caption]);
         ActReOpen1.Visible := True;
      end;
      if ActReOpen2.Caption = '' then
         ActReOpen2.Visible := False
      else begin
         ActReOpen2.Caption := Format('&1 %s',[ActReOpen2.Caption]);
         ActReOpen2.Visible := True;
      end;
      if ActReOpen3.Caption = '' then
         ActReOpen3.Visible := False
      else begin
         ActReOpen3.Caption := Format('&1 %s',[ActReOpen3.Caption]);
         ActReOpen3.Visible := True;
      end;
      if ActReOpen4.Caption = '' then
         ActReOpen4.Visible := False
      else begin
         ActReOpen4.Caption := Format('&1 %s',[ActReOpen4.Caption]);
         ActReOpen4.Visible := True;
      end;

    finally
      peIni.Free;
    end;
  end;

  DragAcceptFiles(MainForm.Handle,true);

end;



procedure TMainForm.FileOpenExecute(Sender: TObject);
begin
  With OpenDialog do
  begin
    Title := '打开';
    Filter := SFileOpenFilter;
    if Execute then
       LoadExeImage(FileName);
  end;
end;

{ 装载Exe文件以分析 }
procedure TMainForm.LoadExeImage(AFileName:String);
var
  peIni:  TIniFile;
  tmpFileName: String;
begin
  tmpFileName := UPPERCASE(ExtractFileExt(AFileName));
  if not((tmpFileName = '.EXE')or(tmpFileName = '.DLL')) then
     exit;
  //如果是PES,直接载入.否则分析PE资源.
  //对一些按钮进行判定.
  if Assigned(CurExeImg) then CurExeImg.Destroy;
  Application.ProcessMessages;
  try
    CurExeImg := TExeImage.CreateImage(AFileName);
  except
    on E:EExeError do MessageBox(handle,PChar(E.Message),PChar(Application.Title),MB_OK);
  end;
  MainForm.Caption := Application.Title + ' - '+AFileName;
  ActionOpenState;
  DisplayPEStructure;

  ////需要重新调整重新打开的各个Caption，并将当前的写入ini文件.
  ////去掉当前已经打开的,其Caption显示三个可重打开的文件，
  ////写入ini并调整顺序与显示.
  tmpFileName := ExtractFilePath(Application.ExeName) + 'peSet.ini';
  if FileExists(tmpFileName) then
  begin
    peIni := TIniFile.Create(tmpFileName);
    try
      ////进行读取操作
      
    finally
      peIni.Free;
    end;
  end;

end;

procedure TMainForm.FileCloseExecute(Sender: TObject);
begin
  ClearPEContent;
  
  ////需要重新调整重新打开的各个Caption，并将当前的写入ini文件.
  ////加入当前已经打开的,取自MainForm.Caption,
  ////Caption显示四个可重打开的文件，

  MainForm.Caption := Application.Title;
  ActionInitState;
end;

procedure TMainForm.FileImportExecute(Sender: TObject);
begin
 //
end;

procedure TMainForm.FileExportExecute(Sender: TObject);
begin
  //
end;

procedure TMainForm.SearchFindFindDialogShow(Sender: TObject);
begin
 //
end;

procedure TMainForm.SearchFindFindDialogFind(Sender: TObject);
begin
//
end;

procedure TMainForm.SearchFindFindDialogClose(Sender: TObject);
begin
//
end;

procedure TMainForm.SearchReplaceReplaceDialogShow(Sender: TObject);
begin
//
end;

procedure TMainForm.ProjOptionsExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.ProjAnalyReportExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.ProjDialogPreviewExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.ProjTestRunExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.ProjCompilerExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.EditCutExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.EditCopyExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.EditPasteExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.EditDeleteExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.EditSelectAllExecute(Sender: TObject);
begin
//
end;

procedure TMainForm.HelpContentExecute(Sender: TObject);
begin
   //
end;

procedure TMainForm.HelpIndexExecute(Sender: TObject);
begin
   //
end;

procedure TMainForm.HelpAboutExecute(Sender: TObject);
begin