resource.pas

Delphi写的PE查看器

{******************************************************************************}
{Copyright(C) 2007,Pefine Security Lab                                         }
{All rights reserved.                                                          }
{                                                                              }
{Abstract:View Win32 PE file information.                                      }
{                                                                              }
{Version:1.01                                                                  }
{Author:WindRand                                                               }
{Date:2007-01-20                                                               }
{******************************************************************************}
unit Resource;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, ComCtrls, StdCtrls, JwaWinNT, ExtCtrls, ExeImage;

type
  TResourceFrm = class(TForm)
    TreeView: TTreeView;
    GroupBox1: TGroupBox;
    Label1: TLabel;
    Edit1: TEdit;
    Label2: TLabel;
    Edit2: TEdit;
    GroupBox3: TGroupBox;
    Label5: TLabel;
    Label6: TLabel;
    Edit5: TEdit;
    Edit6: TEdit;
    Panel1: TPanel;
    Button1: TButton;
    procedure FormShow(Sender: TObject);
    procedure Button1Click(Sender: TObject);
    procedure FormCreate(Sender: TObject);
    procedure TreeViewChange(Sender: TObject; Node: TTreeNode);
  private
    FExeFile: TExeImage;
    procedure LoadResources(ResList: TResourceList; Node: TTreeNode);
    procedure DisplayResources;
    procedure FreeHandle(hFile,mFile:Thandle);
    function GetSectionHeader(tRVA:DWORD;ImageNTHeaders:PImageNtHeaders):PImageSectionHeader;
    procedure UpdateViewPanel;
    procedure UpdateStatusLine(ResItem: TResourceItem);
  public
    { Public declarations }
  end;

var
  ResourceFrm: TResourceFrm;

implementation

uses Main, RXTypes;

const
  ImageMap: array[TResourceType] of Byte = (2,4,5,3,2,2,2,2,2,2,2,2,2,2,2,2,2);

{$R *.dfm}

procedure TResourceFrm.FormShow(Sender: TObject);
var
  TmpExeFile: TExeImage;
begin
  With ResourceFrm do
    begin
      Left:=(Screen.Width div 2)-(Width div 2);
      Top:=(Screen.Height div 2)-(Height div 2);
    end;

  TmpExeFile := TExeImage.CreateImage(Self, MainFrm.PublicFileNameStr);
  if Assigned(FExeFile) then FExeFile.Destroy;
  FExeFile := TmpExeFile;
  DisplayResources;
end;

procedure TResourceFrm.FreeHandle(hFile,mFile:Thandle);
begin
  CloseHandle(hFile);
  CloseHandle(mFile);
end;

function TResourceFrm.GetSectionHeader(tRVA:DWORD;ImageNTHeaders:PImageNtHeaders):PImageSectionHeader;
var
 ImageSection:PImageSectionHeader;
 i:integer;
begin
  ImageSection:=pImageSectionHeader(longword(ImageNTHeaders)+sizeof(TImageNtHeaders));
  for i:=0 to ImageNTHeaders.FileHeader.NumberOfSections-1 do
    begin
      if (tRVA>=LongWord(ImageSection.VirtualAddress)) and
         (tRVA<LongWord(ImageSection.VirtualAddress + ImageSection.Misc.VirtualSize)) then
        begin
          Result:=ImageSection;
          Exit;
        end;
      Inc(ImageSection);
    end;
  Result:=nil;
end;

procedure TResourceFrm.FormCreate(Sender: TObject);
var
  ImageDosHeader:PIMAGEDOSHEADER;
  ImageNTHeaders:PIMAGENTHEADERS;
  ImageSectionHeader:PIMAGESECTIONHEADER;
  ImageRes:PImageResourceDirectory;
  hFile,mFile:THandle;
  hView:Pointer;
  vBase,vRes:LongWord;
  tRVA:Integer;
begin
  hFile:=CreateFile(PChar(MainFrm.PublicFileNameStr),GENERIC_READ,FILE_SHARE_READ,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
  if hFile=INVALID_HANDLE_VALUE then
    begin
      MessageBox(Handle,'Open file error！','Information',MB_OK+MB_ICONERROR);
      CloseHandle(hFile);
      Exit;
    end;
  mFile:=CreateFileMapping(hFile,nil,PAGE_READONLY,0,0,nil);
  if mFile=0 then
    begin
      MessageBox(Handle,'Cannot open the file for memory mapping！','Information',MB_OK+MB_ICONERROR);
      CloseHandle(hFile);
      Exit;
    end;
  hView:=MapViewOfFile(mFile,FILE_MAP_READ,0,0,0);
  if hView=nil then
    begin
      MessageBox(Handle,'Cannot map the file into memory！','Information',MB_OK+MB_ICONERROR);
      FreeHandle(hFile,mFile);
      Exit;
    end;
  ImageDosHeader:=PImageDosHeader(hView);
  if ImageDosHeader.e_magic<>IMAGE_DOS_SIGNATURE then
    begin
      MessageBox(Handle,'This file is not a valid PE！','Information',MB_OK+MB_ICONERROR);
      FreeHandle(hFile,mFile);
      Exit;
    end;
  vBase:=LongWord(ImageDosHeader);
  ImageNTHeaders:=PIMAGENTHEADERS(vBase+LongWord(ImageDosHeader.e_lfanew));
  if ImageNTHeaders.Signature<>IMAGE_NT_SIGNATURE then
    begin
      MessageBox(Handle,'This file is not a valid PE。','Information',MB_OK+MB_ICONINFORMATION);
      FreeHandle(hFile,mFile);
      Exit;
    end;
  vRes:=ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
  if vRes=0 then
    begin
      FreeHandle(hFile,mFile);
      Exit;
    end;
  ImageSectionHeader:=GetSectionHeader(vRes,ImageNTHeaders);
  if ImageSectionHeader=nil then
    begin
      FreeHandle(hFile,mFile);
      Exit;
    end;
  tRVA:=Integer(ImageSectionHeader.VirtualAddress-ImageSectionHeader.PointerToRawData);
  ImageRes:=PImageResourceDirectory(PChar(vRes)-tRVA+vBase);

  Edit1.Text:=IntToHex(ImageRes.NumberOfNamedEntries,4);
  Edit2.Text:=IntToHex(ImageRes.NumberOfIdEntries,4);

  UnmapViewOfFile(hView);
  FreeHandle(hFile,mFile);
end;

procedure TResourceFrm.DisplayResources;
begin
  TreeView.Selected := nil;
  TreeView.Items.Clear;
  LoadResources(FExeFile.Resources, nil);
  with TreeView do
  begin
    SetFocus;
    Selected := Items[0];
  end;
end;

procedure TResourceFrm.LoadResources(ResList: TResourceList; Node: TTreeNode);
var
  I: Integer;
  CNode: TTreeNode;
begin
  for I := 0 to ResList.Count - 1 do
    with ResList[I] do
    begin
      CNode := TreeView.Items.AddChildObject(Node, Name, ResList[I]);
      if IsList then
      begin
        CNode.SelectedIndex := 1;
        LoadResources(List, CNode);
      end else
      begin
        CNode.ImageIndex := ImageMap[ResList[I].ResType];
        CNode.SelectedIndex := CNode.ImageIndex;
      end;

    end;
end;

procedure TResourceFrm.UpdateViewPanel;
var
  R: TResourceItem;
begin
  R:=TResourceItem(TreeView.Selected.Data);
  UpdateStatusLine(R);
end;

procedure TResourceFrm.UpdateStatusLine(ResItem: TResourceItem);
begin
  if ResItem.IsList then
  begin
    Edit5.Text:='';
    Edit6.Text:='';
  end else
  begin
    Edit5.Text:=IntToHex(ResItem.Offset,8);
    Edit6.Text:=IntToHex(ResItem.Size,8);
  end;
end;

procedure TResourceFrm.Button1Click(Sender: TObject);
begin
  Close;
end;

procedure TResourceFrm.TreeViewChange(Sender: TObject; Node: TTreeNode);
begin
  UpdateViewPanel;
end;

end.