sections.pas

Delphi写的PE查看器

{******************************************************************************}
{Copyright(C) 2007,Pefine Security Lab                                         }
{All rights reserved.                                                          }
{                                                                              }
{Abstract:View Win32 PE file information.                                      }
{                                                                              }
{Version:1.01                                                                  }
{Author:WindRand                                                               }
{Date:2007-01-20                                                               }
{******************************************************************************}
unit Sections;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, ComCtrls, StdCtrls, JwaWinNT, PublicUnit;

type
  TSectionsFrm = class(TForm)
    SectionListView: TListView;
    Button1: TButton;
    Button2: TButton;
    procedure FormCreate(Sender: TObject);
    procedure FormShow(Sender: TObject);
    procedure Button2Click(Sender: TObject);
    procedure Button1Click(Sender: TObject);
  private
    procedure FreeHandle(hFile,mFile:Thandle);
    function ReadSecChar(SecStr:String):Cardinal;
  public
    TempSecChar:Cardinal;
  end;

var
  SectionsFrm: TSectionsFrm;

implementation

uses Main, SecHeader;

{$R *.dfm}

procedure TSectionsFrm.FreeHandle(hFile,mFile:Thandle);
begin
  CloseHandle(hFile);
  CloseHandle(mFile);
end;

function TSectionsFrm.ReadSecChar(SecStr:String):Cardinal;
var
  FileNameStr:String;
  ImageDosHeader:PIMAGEDOSHEADER;
  ImageNTHeaders:PIMAGENTHEADERS;
  ImgSectionHeader:PImageSectionHeader;
  hFile,mFile:THandle;
  hView:Pointer;
  vBase:LongWord;
  i:Integer; 
begin
  FileNameStr:=MainFrm.PublicFileNameStr;
  hFile:=CreateFile(PChar(FileNameStr),GENERIC_READ,FILE_SHARE_READ,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
  if hFile=INVALID_HANDLE_VALUE then
    begin
      MessageBox(Handle,'Open file error！','Information',MB_OK+MB_ICONERROR);
      CloseHandle(hFile);
      Exit;
    end;
  mFile:=CreateFileMapping(hFile,nil,PAGE_READONLY,0,0,nil);
  if mFile=0 then
    begin
      MessageBox(Handle,'Cannot open the file for memory mapping！','Information',MB_OK+MB_ICONERROR);
      CloseHandle(hFile);
      Exit;
    end;
  hView:=MapViewOfFile(mFile,FILE_MAP_READ,0,0,0);
  if hView=nil then
    begin
      MessageBox(Handle,'Cannot map the file into memory！','Information',MB_OK+MB_ICONERROR);
      FreeHandle(hFile,mFile);
      Exit;
    end;
  ImageDosHeader:=PImageDosHeader(hView);
  if ImageDosHeader.e_magic<>IMAGE_DOS_SIGNATURE then
    begin
      MessageBox(Handle,'This file is not a valid PE！','Information',MB_OK+MB_ICONERROR);
      FreeHandle(hFile,mFile);
      Exit;
    end;
  vBase:=LongWord(ImageDosHeader);
  ImageNTHeaders:=PIMAGENTHEADERS(vBase+LongWord(ImageDosHeader.e_lfanew));
  if ImageNTHeaders.Signature<>IMAGE_NT_SIGNATURE then
    begin
      MessageBox(Handle,'This file is not a valid PE。','Information',MB_OK+MB_ICONINFORMATION);
      FreeHandle(hFile,mFile);
      Exit;
    end;

  ImgSectionHeader:=pImageSectionHeader(longword(ImageNTHeaders)+sizeof(TImageNtHeaders));
  for i:=0 to ImageNtHeaders.FileHeader.NumberOfSections-1 do
    begin
      if SecStr=Strpas(PChar(@ImgSectionHeader.Name[0])) then
        Result:=ImgSectionHeader.Characteristics;
      Inc(ImgSectionHeader);
    end;
  UnmapViewOfFile(hView);
  FreeHandle(hFile,mFile);
end;

procedure TSectionsFrm.FormCreate(Sender: TObject);
var
  FileNameStr:String;
  ImageDosHeader:PIMAGEDOSHEADER;
  ImageNTHeaders:PIMAGENTHEADERS;
  ImgSectionHeader:PImageSectionHeader;
  hFile,mFile:THandle;
  hView:Pointer;
  vBase:LongWord;
  i:Integer;
  Item:TListItem;  
begin
  FileNameStr:=MainFrm.PublicFileNameStr;
  hFile:=CreateFile(PChar(FileNameStr),GENERIC_READ,FILE_SHARE_READ,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
  if hFile=INVALID_HANDLE_VALUE then
    begin
      MessageBox(Handle,'Open file error！','Information',MB_OK+MB_ICONERROR);
      CloseHandle(hFile);
      Exit;
    end;
  mFile:=CreateFileMapping(hFile,nil,PAGE_READONLY,0,0,nil);
  if mFile=0 then
    begin
      MessageBox(Handle,'Cannot open the file for memory mapping！','Information',MB_OK+MB_ICONERROR);
      CloseHandle(hFile);
      Exit;
    end;
  hView:=MapViewOfFile(mFile,FILE_MAP_READ,0,0,0);
  if hView=nil then
    begin
      MessageBox(Handle,'Cannot map the file into memory！','Information',MB_OK+MB_ICONERROR);
      FreeHandle(hFile,mFile);
      Exit;
    end;
  ImageDosHeader:=PImageDosHeader(hView);
  if ImageDosHeader.e_magic<>IMAGE_DOS_SIGNATURE then
    begin
      MessageBox(Handle,'This file is not a valid PE！','Information',MB_OK+MB_ICONERROR);
      FreeHandle(hFile,mFile);
      Exit;
    end;
  vBase:=LongWord(ImageDosHeader);
  ImageNTHeaders:=PIMAGENTHEADERS(vBase+LongWord(ImageDosHeader.e_lfanew));
  if ImageNTHeaders.Signature<>IMAGE_NT_SIGNATURE then
    begin
      MessageBox(Handle,'This file is not a valid PE。','Information',MB_OK+MB_ICONINFORMATION);
      FreeHandle(hFile,mFile);
      Exit;
    end;

  ImgSectionHeader:=pImageSectionHeader(longword(ImageNTHeaders)+sizeof(TImageNtHeaders));
  for i:=0 to ImageNtHeaders.FileHeader.NumberOfSections-1 do
    begin
      Item:=SectionListView.Items.Insert(SectionListView.Items.Count);
      Item.Caption:=PChar(@ImgSectionHeader.Name[0]);
      Item.SubItems.Add(Format('%.8x',[ImgSectionHeader.VirtualAddress]));
      Item.SubItems.Add(Format('%.8x',[ImgSectionHeader.Misc.VirtualSize]));
      Item.SubItems.Add(Format('%.8x',[ImgSectionHeader.PointerToRawData]));
      Item.SubItems.Add(Format('%.8x',[ImgSectionHeader.SizeOfRawData]));
      Item.SubItems.Add(Format('%.8x',[ImgSectionHeader.Characteristics]));
      Inc(ImgSectionHeader);
    end;
  UnmapViewOfFile(hView);
  FreeHandle(hFile,mFile);
end;

procedure TSectionsFrm.FormShow(Sender: TObject);
begin
  //Interface center
  With SectionsFrm do
    begin
      Left:=(Screen.Width div 2)-(Width div 2);
      Top:=(Screen.Height div 2)-(Height div 2);
    end;
end;

procedure TSectionsFrm.Button2Click(Sender: TObject);
begin
  Close;
end;

procedure TSectionsFrm.Button1Click(Sender: TObject);
begin
  if SectionListView.ItemIndex<0 then
    begin
      MessageBox(Handle,'Please select a section!','Information',MB_OK+MB_ICONINFORMATION);
      Exit;
    end;
  TempSecChar:=ReadSecChar(SectionListView.Selected.Caption);  
  with TSecHeaderFrm.Create(self) do
    begin
      Left:=(Screen.Width div 2)-(Width div 2);
      Top:=(Screen.Height div 2)-(Height div 2);
      NEdit.Text:=SectionListView.Selected.Caption;
      VAEdit.Text:=SectionListView.Selected.SubItems.Strings[0];
      VSEdit.Text:=SectionListView.Selected.SubItems.Strings[1];
      ROEdit.Text:=SectionListView.Selected.SubItems.Strings[2];
      RSEdit.Text:=SectionListView.Selected.SubItems.Strings[3];
      FEdit.Text:=SectionListView.Selected.SubItems.Strings[4];
      if ShowModal=mrok then
        begin
        end;
    end;  
end;

end.