petypes.pas

你用过ExeScope吗？它是能够将Exe文件中的资源进行查看并修改的工具

{***********************************************************************

  Copyright @2002-2003
  Author:  OuChengSong
  Create Date: 2003-01-03

  Descript: PE文件所需的类型，在windows中没有定义的。


***********************************************************************}

unit PETypes;

interface

uses
   Windows;

type

  PIMAGE_RESOURCE_DIRECTORY = ^TImageResourceDirectory;
  _IMAGE_RESOURCE_DIRECTORY = packed record
    Characteristics:DWORD;
    TimeDateStamp:DWORD;
    MajorVersion:WORD;
    MinorVersion:WORD;
    NumberOfNamedEntries:WORD;
    NumberOfIdEntries:WORD;
  end;
  TImageResourceDirectory = _IMAGE_RESOURCE_DIRECTORY;

  PIMAGE_RESOURCE_DIRECTORY_ENTRY = ^TImageResourceDirectoryEntry;
  _IMAGE_RESOURCE_DIRECTORY_ENTRY = packed record
    Name:DWORD;         { NameOffset:31,NameIsString:1 }
//    Id:WORD;
    OffsetToData:DWORD; { OffsetToDirectory:31,DataIsDirectory:1 }
  end;
  TImageResourceDirectoryEntry = _IMAGE_RESOURCE_DIRECTORY_ENTRY;

  PIMAGE_RESOURCE_DIRECTORY_STRING = ^TImageResourceDirectoryString;
  _IMAGE_RESOURCE_DIRECTORY_STRING = packed record
    Length:WORD;
    NameString:CHAR;
  end;
  TImageResourceDirectoryString = _IMAGE_RESOURCE_DIRECTORY_STRING;


  PIMAGE_RESOURCE_DIR_STRING_U = ^TImageResourceDirStringU;
  _IMAGE_RESOURCE_DIR_STRING_U = packed record
    Length:WORD;
    NameString:WCHAR;
  end;
  TImageResourceDirStringU = _IMAGE_RESOURCE_DIR_STRING_U;

  PIMAGE_RESOURCE_DATA_ENTRY = ^TImageResourceDataEntry;
  _IMAGE_RESOURCE_DATA_ENTRY = packed record
    OffsetToData:DWORD;
    Size:DWORD;
    CodePage:DWORD;
    Reserved:DWORD;
  end;
  TImageResourceDataEntry = _IMAGE_RESOURCE_DATA_ENTRY;

  //光标和图标入口
  PIconHeader = ^TIconHeader;
  TIconHeader = packed record
    wReserved: Word;         { Currently zero }
    wType: Word;             { 1=icons,2=Cursor }
    wCount: Word;            { Number of components }
  end;

  PIconResInfo = ^TIconResInfo;
  TIconResInfo = packed record
    bWidth: Byte;
    bHeight: Byte;
    bColorCount: Byte;
    bReserved: Byte;
    wPlanes: Word;
    wBitCount: Word;
    lBytesInRes: DWORD;
    wNameOrdinal: Word;      { Points to component }
  end;

  PCursorResInfo = ^TCursorResInfo;
  TCursorResInfo = packed record
    wWidth: Word;
    wHeight: Word;
    wPlanes: Word;
    wBitCount: Word;
    lBytesInRes: DWORD;
    wNameOrdinal: Word;      { Points to component }
  end;

  { ICON文件的头信息结构}
  PIconFileHeader = ^TIconFileHeader;
  TIconFileHeader = packed record
		idReserved: WORD;     // Reserved
		idType: WORD;         // resource type (1 for icons)
		idCount: WORD;        // how many images?
		bWidth: BYTE;         // Width of the image
		bHeight: BYTE;        // Height of the image (times 2)
		bColorCount: BYTE;    // Number of colors in image
		bReserved: BYTE;      // Reserved
		wPlanes: WORD;        // Color Planes
		wBitCount: WORD;      // Bits per pixel
		dwBytesInRes: DWORD;   // how many bytes in this resource?
		dwImageOffset: DWORD;  // where in the file is this image =SizeOf(TIconFileHeader)
  end;

  { 快捷键的结构 }
  PAccelerator = ^TAccelerator;
  TAccelerator = packed record
    wVirtKey: WORD; //虚拟键
    wKey:  WORD;    //字符键
    wID:  WORD;     //ID
    wReserved:WORD; //保留值
  end;

  { 版本信息的几类结构 }
  //固定文件版本信息内容
  PVSFixedFileInfo = ^TVSFixedFileInfo;
  TVSFixedFileInfo = packed record { Length=$34 即52 Bytes}
    dwSignature: DWORD;     //一般为 $FEEF04BD
    dwStrucVersion:  DWORD; //高位为MajorVersion,低位为MinorVersion
    dwFileVersionMS: DWORD;
    dwFileVersionLS: DWORD;
    dwProductVersionMS: DWORD;
    dwProductVersionLS: DWORD;
    dwFileFlagsMask: DWORD;
    dwFileFlags:     DWORD;
    dwFileOS:  DWORD;
    dwFileType:DWORD;
    dwFileSubType: DWORD;
    dwFileDateMS:  DWORD;
    dwFileDateLS:  DWORD;
  end;
  //
  // 后面所有的加入了Header，是因为省略了最后的注释部分无法确定长度.
  // 其实WChar[]最好不要指定长度，而是检测"\0"表示字符串结尾.
  PVSVersionInfoHeader = ^TVSVersionInfoHeader;
  TVSVersionInfoHeader = packed record
    wLength:  WORD;      //版本信息内容的字节大小
    wValueLength: WORD;  //TVSFixedFileInfo结构的字节大小,此处为$34
    wType:  WORD;  //0:版本信息为Binary-Data, 1: Text-Data
    szKey:  array[0..15] of WChar;  //此处为"VS_VERSION_INFO\0"的UniCode,每个占2 bytes.
    padding1: WORD;  //此处为0
    value:  TVSFixedFileInfo;
    //padding2 TStringFileInfo
    //padding3 TVerFileInfo
  end;
  //
  PStringFileInfoHeader = ^TStringFileInfoHeader;
  TStringFileInfoHeader = packed record
    wLength: WORD;
    wValueLength: WORD;
    wType:  WORD;
    szKey: array[0..14] of WChar; // "StringFileInfo\0"
    //padding1:TStringTable;
  end;

  PStringValueHeader = ^TStringValueHeader;
  TStringValueHeader = packed record
    wLength: WORD;
    wValueLength:WORD;
    wType: WORD;
    //padding1: String; //其中关键字以零结尾的字符串.
  end;

  PStringTableHeader = ^TStringTableHeader;
  TStringTableHeader = packed record
    wLength: WORD;
    wValueLength: WORD;
    wType: WORD;
    szKey: array[0..8] of WChar; //语言特性 如中文简体("080404B0\0")等
    //value: TStringValueHeader;
  end;

  PVerFileInfoHeader = ^TVerFileInfoHeader;
  TVerFileInfoHeader = packed record
    wLength:  WORD;
    wValueLength: WORD;
    wType: WORD;
    szKey: array[0..11] of WChar; // "VerFileInfo\0"
    padding: WORD;  //=00
    // value TVer;
  end;

  PVerHeader = ^TVerHeader;
  TVerHeader = packed record
    wLength: WORD;
    wValueLength:WORD;
    wType: WORD;
    szKey: array[0..11] of WChar; // "Translation\0" --此处有可能为变长
    padding: WORD;  //==00
    //value: array of WORD;   [0..TVarHeader.wLength-SizeOf(TVerHeader)]
    { 对于Translation来讲应是如下
    wLanguageID: WORD; //如中文简体 $0804
    wCodePage:  WORD;  //如UniCode  $04B0
    }
  end;

  PVerSimpleHeader = ^TVerSimpleHeader;
  TVerSimpleHeader = packed record
    wLength: WORD;
    wValueLength:WORD;
    wType: WORD;
  end;

  { 资源中菜单项的结构 }
  PMenuItemInfo = ^TMenuItemInfo;
  TMenuItemInfo = packed record
     //WORD  最前面的2个WORD(4 Bytes)不知道是什么含义?
     mtOption: WORD; //如果mtOption是MF_POPUP,则后面不保存mtID而直接默认为0
     mtID:     WORD
     //WChar[]  //以\0结束的宽字符数组，此处保存的是菜单标题
  end;

  { 工具栏结构 }
  PToolItemInfo = ^TToolItemInfo;
  TToolItemInfo = packed record
     ttNum:   WORD; //工具栏个数
     ttWidth: WORD; //工具按钮的宽度
     ttHeight:WORD; //工具按钮的高度
     ttCount: WORD; //工具按钮的个数
     //ttID: WORD[] //是数组,ID值对应到快捷键的ID.
  end;

  { 对话框数据的结构}
  PDialogDataInfo = ^TDialogDataInfo;
  TDialogDataInfo = packed record
    dlgID: WORD;
    dlgUnknown1: WORD;  //暂不知道是什么意思
    dlgCount: WORD;  //表示后面的长度,是Byte,
    dlgUnknown2: WORD;  //也不知道有什么用,发现都是0
    //xxx[]: Byte;
    //最最后两个字节是00,不知有什么用。
  end;

  { 导入 }
  TIMAGE_IMPORT_DESCRIPTOR = packed record
    OriginalFirstThunk: DWORD; // RVA to orig. 1st thunk
    TimeDateStamp     : DWORD; // unbound
    ForwarderChain    : DWORD; // no forwarders
    Name              : DWORD; // RVA to DLL name
    FirstThunk        : DWORD; // RVA to 1st thunk
  end;

  { 导出函数表的结构 }
  TExportDirectory = packed record
    characteristics: DWORD;
    TimeDateStamp:   DWORD;
    majorVersion:    WORD;
    minorVersion:    WORD;
    Name:    DWORD;   //保存名称的地址
    Base:    DWORD;
    NumberOfFunctions: DWORD;
    NumberOfNames:     DWORD;
    AddressOfFunctions:DWORD;
    AddressOfNames:    DWORD;
    AddressOfNameOrdinals: DWORD;
  end;

const

  IMAGE_RESOURCE_NAME_IS_STRING    = $80000000;
  IMAGE_RESOURCE_DATA_IS_DIRECTORY = $80000000;
  IMAGE_OFFSET_STRIP_HIGH          = $7FFFFFFF;

  { File Machine }
  IMAGE_FILE_MACHINE_WCEMIPSV2         = $0169;  // MIPS little-endian WCE v2
  IMAGE_FILE_MACHINE_SH3               = $01a2;  // SH3 little-endian
  IMAGE_FILE_MACHINE_SH3E              = $01a4;  // SH3E little-endian
  IMAGE_FILE_MACHINE_SH4               = $01a6;  // SH4 little-endian
  IMAGE_FILE_MACHINE_SH5               = $01a8;  // SH5
  IMAGE_FILE_MACHINE_ARM               = $01c0;  // ARM Little-Endian
  IMAGE_FILE_MACHINE_THUMB             = $01c2;
  IMAGE_FILE_MACHINE_ARM33             = $01d3;
  IMAGE_FILE_MACHINE_IA64              = $0200;  // Intel 64
  IMAGE_FILE_MACHINE_MIPS16            = $0266;  // MIPS
  IMAGE_FILE_MACHINE_ALPHA64           = $0284;  // ALPHA64
  IMAGE_FILE_MACHINE_MIPSFPU           = $0366;  // MIPS
  IMAGE_FILE_MACHINE_MIPSFPU16         = $0466;  // MIPS
//  IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
  IMAGE_FILE_MACHINE_AMD64             = $0500;  // AMD K8
  IMAGE_FILE_MACHINE_TRICORE           = $0520;  // Infineon
  IMAGE_FILE_MACHINE_CEF               = $0CEF;

  { File Characteristics }
  IMAGE_FILE_LARGE_ADDRESS_AWARE       = $0020;  // App can handle >2gb addresses

implementation

end.