exeimage.pas

你用过ExeScope吗？它是能够将Exe文件中的资源进行查看并修改的工具

      tmpStrType := '图标';
    end;
    tmpVar := VarArrayCreate([0,FGroupVarCount-1],varVariant);

    tmpAddr :=AOffset;
    tmpValue:=Format('%.4x',[wReserved]);
    tmpMemo :='保留值0';
    tmpVar[0]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

    tmpAddr := tmpAddr+SizeOf(wReserved);
    tmpValue:=Format('%.4x',[wType]);
    tmpMemo :=Format('类型：%s',[tmpStrType]);
    tmpVar[1]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

    tmpAddr := tmpAddr+SizeOf(wType);
    tmpValue:=Format('%.4x',[wCount]);
    tmpMemo :=Format('%s个数：%d',[tmpStrType,wCount]);
    tmpVar[2]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);
  end;
  if tmpIconHeader.wType=1 then     //类型为ICON
  begin
    for i:=0 to tmpIconHeader.wCount-1 do
    begin
      FExeStream.Read(tmpIconResInfo,SizeOf(tmpIconResInfo));
      with tmpIconResInfo do
      begin
        tmpAddr:= AOffset+SizeOf(tmpIconHeader)+IconFieldCount*i;
        tmpValue:=Format('%.2x',[bWidth]);
        tmpMemo :=Format('宽度：%d',[bWidth]);
        tmpVar[IconFieldCount*i+3]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(bWidth);
        tmpValue:=Format('%.2x',[bHeight]);
        tmpMemo :=Format('高度：%d',[bHeight]);
        tmpVar[IconFieldCount*i+4]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(bHeight);
        tmpValue:=Format('%.2x',[bColorCount]);
        if bColorCount=0 then
          tmpMemo :=Format('颜色：%d',[256])
        else
          tmpMemo :=Format('颜色：%d',[bColorCount]);

        tmpVar[IconFieldCount*i+5]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(bColorCount);
        tmpValue:=Format('%.2x',[bReserved]);
        tmpMemo :='保留值1';
        tmpVar[IconFieldCount*i+6]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(bReserved);
        tmpValue:=Format('%.4x',[wPlanes]);
        tmpMemo:=Format('位面：%d',[wPlanes]);;
        tmpVar[IconFieldCount*i+7]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(wPlanes);
        tmpValue:=Format('%.4x',[wBitCount]);
        tmpMemo :=Format('位数：%d',[wBitCount]);
        tmpVar[IconFieldCount*i+8]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(wBitCount);
        tmpValue:=Format('%.8x',[lBytesInRes]);
        tmpMemo:=Format('字节大小：%d',[lBytesInRes]);;
        tmpVar[IconFieldCount*i+9]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(lBytesInRes);
        tmpValue:=Format('%.4x',[wNameOrdinal]);
        tmpMemo:=Format('名称序号：%d',[wNameOrdinal]);
        tmpVar[IconFieldCount*i+10]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);
      end;
    end;
  end
  else if tmpIconHeader.wType=2 then  //类型为CURSOR
  begin
    for i:=0 to tmpIconHeader.wCount-1 do
    begin
      FExeStream.Read(tmpCursorResInfo,SizeOf(tmpCursorResInfo));
      with tmpCursorResInfo do
      begin
        tmpAddr:= AOffset+SizeOf(tmpIconHeader)+CursorFieldCount*i;
        tmpValue:=Format('%.4x',[wWidth]);
        tmpMemo:=Format('宽度：%d',[wWidth]);
        tmpVar[CursorFieldCount*i+3]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(wWidth);
        tmpValue:=Format('%.4x',[wHeight]);
        tmpMemo:=Format('高度：%d',[wHeight div 2]);
        tmpVar[CursorFieldCount*i+4]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(wHeight);
        tmpValue:=Format('%.4x',[wPlanes]);;
        tmpMemo:=Format('位面：%d',[wPlanes]);;
        tmpVar[CursorFieldCount*i+5]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(wPlanes);
        tmpValue:=Format('%.4x',[wBitCount]);;
        tmpMemo:=Format('位数：%d',[wBitCount]);;
        tmpVar[CursorFieldCount*i+6]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(wBitCount);
        tmpValue:=Format('%.8x',[lBytesInRes]);;
        tmpMemo:=Format('字节大小：%d',[lBytesInRes]);;
        tmpVar[CursorFieldCount*i+7]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);

        tmpAddr:=tmpAddr+SizeOf(lBytesInRes);
        tmpValue:=Format('%.4x',[wNameOrdinal]);;
        tmpMemo:=Format('名称序号：%d',[wNameOrdinal]);;
        tmpVar[CursorFieldCount*i+8]:=VarArrayOf([tmpAddr,tmpValue,tmpMemo]);
      end;
    end;
  end;
  result:=tmpVar;
end;

function TExeImage.GetCursorResInfo(AOffset: Integer): TStringList;
var
  tmpIconHeader: TIconHeader;
  tmpCursorResInfo: TCursorResInfo;
  tmpStrList: TStringList;
  tmpStr:  String;
  i: Word;
begin
//
  tmpStrList := TStringList.Create;
  FExeStream.Seek(AOffset,0);
  FExeStream.Read(tmpIconHeader,SizeOf(tmpIconHeader));
  for i:=0 to tmpIconHeader.wCount-1 do
  begin
    FExeStream.Read(tmpCursorResInfo,SizeOf(tmpCursorResInfo));
    with tmpCursorResInfo do
    begin
      tmpStr := InttoStr(wNameOrdinal)+': ';
      tmpStr := tmpStr + InttoStr(wWidth) + '*' + InttoStr(wHeight div 2);
    end;
    tmpStrList.Add(tmpStr);
  end;
  result := tmpStrList;
  //tmpStrList.Free;  //此句必须注释
end;

function TExeImage.GetIconResInfo(AOffset: Integer): TStringList;
var
  tmpIconHeader: TIconHeader;
  tmpIconResInfo: TIconResInfo;
  tmpStrList: TStringList;
  tmpStr:  String;
  i: Word;
begin
//
  tmpStrList := TStringList.Create;
  FExeStream.Seek(AOffset,0);
  FExeStream.Read(tmpIconHeader,SizeOf(tmpIconHeader));
  for i:=0 to tmpIconHeader.wCount-1 do
  begin
    FExeStream.Read(tmpIconResInfo,SizeOf(tmpIconResInfo));
    with tmpIconResInfo do
    begin
      tmpStr := InttoStr(wNameOrdinal)+': ';
      tmpStr := tmpStr + InttoStr(bWidth) + '*' + InttoStr(bHeight) + ' ';
      if bColorCount = 0 then
         tmpStr:= tmpStr + '256色'
      else
         tmpStr := tmpStr + InttoStr(bColorCount)+'色';
    end;
    tmpStrList.Add(tmpStr);
  end;
  result := tmpStrList;
  //tmpStrList.Free; //此句必须注释
end;

 { 取得字串表的字串信息 }
function TExeImage.GetStringTable(AOffset, ASize: Integer): TStringList;
const
  StringsPerBlock=16;
  //Max_Buf=1024;
var
  tmpStrList: TStringList;
  ResBuffer:array of WChar;
  Cnt:Integer;
  i,Len: Word;
  tmpStr: String;
begin
  tmpStrList := TStringList.Create;
  FExeStream.Seek(AOffSet,soFromBeginning);
  Cnt:=0;
  while Cnt<ASize do
  begin
    FExeStream.Read(Len,SizeOf(Len));
    Cnt:=Cnt + SizeOf(Len) + Len*SizeOf(WChar);
    if Len>0 then
    begin
      SetLength(ResBuffer,Len);
      tmpstr:='';
      //如果超出范围则切掉
      if Cnt>ASize then Len := Len-(Cnt-ASize) div SizeOf(WChar);
      for i:=0 to Len-1 do
      begin
        FExeStream.Read(ResBuffer[i],SizeOf(ResBuffer[i]));
        //将控制字字符进行处理.
        if Ord(ResBuffer[i]) in [0..31] then
          tmpStr := tmpStr+Format('$%.2x',[Ord(ResBuffer[i])])
        else
          tmpStr:=tmpStr+ResBuffer[i];
      end;
      tmpStrList.Add(tmpStr);
    end;
  end;
  result := tmpStrList;
end;

 {  }
function TExeImage.GetExportInfo:TStringList;
var
  tmpStrList:  TStringList;
  tmpExportDir:TExportDirectory;
  tmpName: Char;
  tmpOrdinals:WORD;
  tmpAddress,tmpOffset: DWORD;
  tmpStr: String;
  i: Integer;
begin
  tmpStrList := TStringList.Create;
  tmpOffset := FPENTHead.OptionalHeader.DataDirectory[0].VirtualAddress - ExportDirAddr;
  with FExeStream do
  begin
    Seek(ExportDirAddr,0);
    Read(tmpExportDir,SizeOf(tmpExportDir));
    //读取序号
    Seek(tmpExportDir.AddressOfNameOrdinals-tmpOffset,0);
    for i:=0 to tmpExportDir.NumberOfNames -1 do
    begin
      Read(tmpOrdinals,SizeOf(tmpOrdinals));
      tmpStr := Format('%.8x,',[tmpExportDir.Base+tmpOrdinals-1]);
      tmpStrList.Add(tmpStr);
    end;
    Seek(tmpExportDir.AddressOfNames-tmpOffset,0);
    for i:=0 to tmpExportDir.NumberOfNames-1 do
    begin
      Read(tmpAddress,SizeOf(tmpAddress));
      tmpStr := '';
      if tmpAddress<>0 then
      begin
        Seek(tmpAddress-tmpOffset,0);
        //获取导出函数名称.
        repeat
          Read(tmpName,SizeOf(tmpName));
          tmpStr := tmpStr + tmpName;
        until tmpName=Chr(0);
        tmpStr := trim(tmpStr);
      end;
      Seek(tmpExportDir.AddressOfNames + (i+1)*SizeOf(tmpAddress) - tmpOffset,0);
      tmpStr := Format('%.8x,%s',[tmpAddress-tmpOffset,tmpStr]); //用此值表示地址即文件地址,
      tmpStrList.Strings[i] := tmpStrList.Strings[i]+tmpStr;
    end;
  end;
  result := tmpStrList;
end;

 { 取得快捷键列表的信息,结构为ID,类型,Key }
function TExeImage.GetAccelerator(AOffset,ASize:Integer):TStringList;
var
  tmpStrList: TStringList;
  tmpAcce: TAccelerator;
  CurSize: Integer;
  ID:Integer;
  tmpVirtKey:Word;
  tmpKey,tmpType :String; //tmpType,
begin

  tmpStrList := TStringList.Create;
  FExeStream.Seek(AOffSet,soFromBeginning);
  CurSize := SizeOf(tmpAcce);
  while CurSize <= ASize do
  begin
    FExeStream.Read(tmpAcce,SizeOf(tmpAcce));
    ID := tmpAcce.wID;
    tmpVirtKey := tmpAcce.wVirtKey;
    tmpType:='';
    tmpKey:='';

    if IsVirtField(tmpVirtKey,FVIRTKEY)  then tmpType := tmpType + 'VIRTKEY︱';
    if IsVirtField(tmpVirtKey,FNOINVERT) then tmpType := tmpType + 'NOINVERT︱';
    if IsVirtField(tmpVirtKey,FALT)     then tmpKey := tmpKey + 'Alt + ';
    if IsVirtField(tmpVirtKey,FCONTROL) then tmpKey := tmpKey + 'Ctrl + ';
    if IsVirtField(tmpVirtKey,FSHIFT)   then tmpKey := tmpKey + 'Shift + ';

    //去掉最后的"|"
    if tmpType<>'' then
       tmpType := Copy(tmpType,0,Length(tmpType)-2);

    tmpKey := tmpKey + TransAccelKey(tmpAcce.wKey);
    tmpStrList.Add(Format('%d,%s,%s',[ID,tmpType,tmpKey]));
    CurSize := CurSize + SizeOf(tmpAcce);
  end;

  result:=tmpStrList;
end;

 { 取得版本信息 -  文件标准信息 }
function TExeImage.GetVSFixedFileInfo(AOffset:Integer):TStringList;
var
  tmpStrList: TStringList;
  tmpVSHeader:TVSVersionInfoHeader;
  tmpVerMS,tmpVerLS: DWORD;
  tmpStr: String;
begin
  //
  tmpStrList := TStringList.Create;
  FExeStream.Seek(AOffSet,soFromBeginning);
  FExeStream.Read(tmpVSHeader,SizeOf(tmpVSHeader));
  //
  //文件版本
  tmpVerMS := tmpVSHeader.value.dwFileVersionMS;
  tmpVerLS := tmpVSHeader.value.dwFileVersionLS;
  tmpStr:=Format('%d.%d.%d.%d',[HIWORD(tmpVerMS),LOWORD(tmpVerMS),HIWORD(tmpVerLS),LOWORD(tmpVerLS)]);
  tmpStrList.Add(tmpStr);
  //产品版本
  tmpVerMS := tmpVSHeader.value.dwProductVersionMS;
  tmpVerLS := tmpVSHeader.value.dwProductVersionLS;
  tmpStr:=Format('%d.%d.%d.%d',[HIWORD(tmpVerMS),LOWORD(tmpVerMS),HIWORD(tmpVerLS),LOWORD(tmpVerLS)]);
  tmpStrList.Add(tmpStr);
  //文件标志
  tmpstrList.Add(Format('%d',[tmpVSHeader.value.dwFileFlags]));
  //文件系统
  case LOWORD(tmpVSHeader.value.dwFileOS) and $0000000F of
    $0000: tmpStr:='VOS_BASE';       //VOS_BASE,
    $0001: tmpStr:='Windows 16位';   //VOS_Windows16
    $0002: tmpStr:='PM 16位';        //VOS_PM16
    $0003: tmpStr:='PM 32位';        //VOS_PM32
    $0004: tmpStr:='Windows 32位'    //VOS_WINDOWS32
    else tmpStr:='其它';  //VOS_UNKNOWN
  end;
  tmpStrList.Add(tmpStr);

  //文件类型
  case tmpVSHeader.value.dwFileType of
    VFT_UNKNOWN: tmpStr:='VFT_UNKNOWN';   //VFT_UNKNOWN
    VFT_APP: tmpStr:='应用程序';   //VFT_APP
    VFT_DLL: tmpStr:='动态链接库'; //VFT_DLL
    VFT_DRV:  tmpStr:='驱动程序';  //VFT_DRV
    VFT_FONT: tmpStr:='字体库';    //VFT_FONT
    VFT_VXD:  tmpStr:='VXD';       //VFT_VXD
    VFT_STATIC_LIB: tmpStr:='静态链接库'; //VFT_STATIC_LIB
    else tmpStr:='其它';     //VFT_UNKNOWN
  end;
  tmpStrList.Add(tmpStr);

  //文件子类型
  tmpStrList.Add(Format('%d',[tmpVSHeader.value.dwFileSubType]));

  result:=tmpStrList;
end;

 { 取得版本信息 -  文件描述信息 }
function TExeImage.GetVSStringFileInfo(AOffset:Integer):TStringList;
var
  tmpStrList,tmpFixedFileInfoList: TStringList;
  tmpStringFileInfoHeader: TStringFileInfoHeader;
  tmpStringTableHeader:  TStringTableHeader;
  tmpStringInfoLen:  Integer;
  tmpStr,tmpComp: String;
  tmpWChar: WChar;