unit1.pas

知道大家有没有用过PEDUMP

//   
//      -'`"_         -'`" \
//     /     \       /      "
//    /     /\\__   /  ___   \    ADDRESS:
//   |      | \  -"`.-(   \   |     143 mailbox XI'AN Science and Technology University
//   |      |  |     | \"  |  |   ZIP CODE:
//   |     /  /  "-"  \  \    |     710054
//    \___/  /  (o o)  \  (__/    NAME:
//         __| _     _ |__          ZHONG WAN
//        (      ( )      )       EMAIL: 
//         \_\.-.___.-./_/          [e-mail]
//           __  | |  __          HOMEPAGE: 
//          |  \.| |./  |           http://www.delphibox.com
//          | '#.   .#' |         OICQ:
//          |__/ '"" \__|           6036742
//        -/             \-
//

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
  StdCtrls, Grids, ComCtrls, Buttons, ExtCtrls, Menus, ShellAPI, jpeg,
  ShlObj, ActiveX, ComObj ;

type
  TForm1 = class(TForm)
    OpenDialog1: TOpenDialog;
    Panel1: TPanel;
    StatusBar1: TStatusBar;
    btn_DumpFile: TBitBtn;
    PageControl1: TPageControl;
    TabSheet1: TTabSheet;
    TabSheet2: TTabSheet;
    TabSheet3: TTabSheet;
    TabSheet4: TTabSheet;
    TabSheet5: TTabSheet;
    TabSheet6: TTabSheet;
    Edit_FileName: TEdit;
    Panel_Header: TPanel;
    Panel_OptionalHeader: TPanel;
    lv_Directory: TListView;
    Panel6: TPanel;
    TreeView1: TTreeView;
    StaticText_1: TStaticText;
    StaticText_2: TStaticText;
    StaticText_3: TStaticText;
    StaticText_4: TStaticText;
    StaticText_5: TStaticText;
    Bevel1: TBevel;
    Bevel2: TBevel;
    StaticText_6: TStaticText;
    StaticText_7: TStaticText;
    StaticText_8: TStaticText;
    Bevel4: TBevel;
    Edit_1: TEdit;
    Edit_2: TEdit;
    Edit_3: TEdit;
    Edit_4: TEdit;
    Edit_5: TEdit;
    Edit_6: TEdit;
    Edit_7: TEdit;
    Edit_8: TEdit;
    GroupBox1: TGroupBox;
    StaticText_9: TStaticText;
    Edit_9: TEdit;
    Bevel6: TBevel;
    StaticText10: TStaticText;
    cb_file_1: TCheckBox;
    cb_file_2: TCheckBox;
    cb_file_11: TCheckBox;
    cb_file_12: TCheckBox;
    cb_file_13: TCheckBox;
    cb_file_14: TCheckBox;
    cb_file_3: TCheckBox;
    cb_file_4: TCheckBox;
    cb_file_5: TCheckBox;
    cb_file_15: TCheckBox;
    cb_file_6: TCheckBox;
    cb_file_8: TCheckBox;
    cb_file_7: TCheckBox;
    cb_file_9: TCheckBox;
    cb_file_10: TCheckBox;
    btn_OpenFile: TBitBtn;
    Shape1: TShape;
    StaticText0: TStaticText;
    Bevel7: TBevel;
    StaticText11: TStaticText;
    SaveDialog1: TSaveDialog;
    Bevel8: TBevel;
    StaticText_10: TStaticText;
    Edit_10: TEdit;
    StaticText_24: TStaticText;
    StaticText_23: TStaticText;
    StaticText_25: TStaticText;
    StaticText_13: TStaticText;
    Edit_13: TEdit;
    Edit_25: TEdit;
    Edit_23: TEdit;
    Edit_24: TEdit;
    StaticText_28: TStaticText;
    StaticText_29: TStaticText;
    StaticText_30: TStaticText;
    StaticText_11: TStaticText;
    Edit_11: TEdit;
    Edit_28: TEdit;
    Edit_29: TEdit;
    Edit_30: TEdit;
    Bevel12: TBevel;
    StaticText_26: TStaticText;
    Edit_26: TEdit;
    StaticText_27: TStaticText;
    Edit_27: TEdit;
    StaticText_31: TStaticText;
    Edit_31: TEdit;
    StaticText_12: TStaticText;
    Edit_12: TEdit;
    StaticText_14: TStaticText;
    Edit_14: TEdit;
    StaticText_15: TStaticText;
    Edit_15: TEdit;
    StaticText_16: TStaticText;
    Edit_16: TEdit;
    StaticText_17: TStaticText;
    Edit_17: TEdit;
    StaticText_18: TStaticText;
    Edit_18: TEdit;
    StaticText_34: TStaticText;
    Edit_34: TEdit;
    StaticText_35: TStaticText;
    Edit_35: TEdit;
    StaticText_19: TStaticText;
    Edit_19: TEdit;
    StaticText_20: TStaticText;
    Edit_20: TEdit;
    StaticText_22: TStaticText;
    Edit_22: TEdit;
    StaticText_21: TStaticText;
    Edit_21: TEdit;
    StaticText_33: TStaticText;
    Edit_33: TEdit;
    StaticText_32: TStaticText;
    Edit_32: TEdit;
    Panel4: TPanel;
    pc_Section: TPageControl;
    TabSheet0: TTabSheet;
    StaticText38: TStaticText;
    Edit1: TEdit;
    StaticText39: TStaticText;
    Edit2: TEdit;
    Edit3: TEdit;
    StaticText40: TStaticText;
    StaticText41: TStaticText;
    StaticText42: TStaticText;
    StaticText43: TStaticText;
    StaticText44: TStaticText;
    StaticText46: TStaticText;
    StaticText47: TStaticText;
    StaticText45: TStaticText;
    Edit9: TEdit;
    Edit8: TEdit;
    Edit7: TEdit;
    Edit10: TEdit;
    Edit5: TEdit;
    Edit6: TEdit;
    Edit4: TEdit;
    GroupBox2: TGroupBox;
    CheckBox1: TCheckBox;
    CheckBox2: TCheckBox;
    CheckBox3: TCheckBox;
    CheckBox4: TCheckBox;
    CheckBox5: TCheckBox;
    CheckBox6: TCheckBox;
    CheckBox7: TCheckBox;
    CheckBox8: TCheckBox;
    CheckBox9: TCheckBox;
    CheckBox10: TCheckBox;
    CheckBox11: TCheckBox;
    CheckBox12: TCheckBox;
    CheckBox13: TCheckBox;
    CheckBox14: TCheckBox;
    Bevel3: TBevel;
    StaticText_39: TStaticText;
    Edit_39: TEdit;
    StaticText_40: TStaticText;
    Edit_40: TEdit;
    StaticText_41: TStaticText;
    Edit_41: TEdit;
    StaticText_37: TStaticText;
    Edit_37: TEdit;
    StaticText_38: TStaticText;
    Edit_38: TEdit;
    StaticText_36: TStaticText;
    Edit_36: TEdit;
    Bevel5: TBevel;
    ProgressBar1: TProgressBar;
    PopupMenu1: TPopupMenu;
    E1: TMenuItem;
    C1: TMenuItem;
    ProductName: TLabel;
    ProgramIcon: TImage;
    Copyright: TLabel;
    Version: TLabel;
    lblOs: TLabel;
    lblMemory: TLabel;
    lb_email: TLabel;
    lb_HomePage: TLabel;
    homepage: TLabel;
    email: TLabel;
    Bevel9: TBevel;
    Bevel10: TBevel;
    Label1: TLabel;
    Timer1: TTimer;
    Label2: TLabel;
    StaticText54: TStaticText;
    btn_OutText: TBitBtn;
    TreeView2: TTreeView;
    F1: TMenuItem;
    procedure btn_DumpFileClick(Sender: TObject);
    procedure FormCreate(Sender: TObject);
    procedure btn_OpenFileClick(Sender: TObject);
    procedure btn_OutTextClick(Sender: TObject);
    procedure StatusBar1DrawPanel(StatusBar: TStatusBar;
      Panel: TStatusPanel; const Rect: TRect);
    procedure TreePop1Click(Sender: TObject);
    procedure ServiceClick(Sender: TObject);
    procedure FormShow(Sender: TObject);
    procedure PageControl1Change(Sender: TObject);
    procedure Timer1Timer(Sender: TObject);
    procedure TreeView1DblClick(Sender: TObject);
    procedure PopupMenu1Popup(Sender: TObject);
    procedure F1Click(Sender: TObject);
  private
    Dumped:Boolean;
    procedure WMDropFiles(var Msg:TWMDropFiles); message WM_DROPFILES;
    procedure ResetForm;
    procedure AddInfoToListView(ListView: TListView; Info1, Info2, Info3,
      Info4, Info5: String);
    procedure CheckFileCharacteristics(Value:Cardinal);
    function CheckFileMachine(Value: Cardinal): String;
    function AddValue(W: Byte; Value: Cardinal): String;
    procedure CreateSectionTabSheet(SectionIndex:Integer; title: String;
      info1, info2, info3, info4, info5,
      info6, info7, info8, info9, info10: Cardinal);
    procedure DoPEDump(FileName:String);
    procedure GetBuildInfo;
    procedure GetMemoryInfo;
    procedure GetOSInfo;
    function CheckResourceType(W: Byte): String;
    function GetShortcutTarget(ShortcutFilename: String): String;
    { Private declarations }
  public
    { Public declarations }
  end;

const
  Ver='1.92';

type
  PIMAGE_RESOURCE_DIRECTORY = ^TImageResourceDirectory;
  _IMAGE_RESOURCE_DIRECTORY = packed record
    Characteristics:DWORD;
    TimeDateStamp:DWORD;
    MajorVersion:WORD;
    MinorVersion:WORD;
    NumberOfNamedEntries:WORD;
    NumberOfIdEntries:WORD;
  end;
  TImageResourceDirectory = _IMAGE_RESOURCE_DIRECTORY;

  PIMAGE_RESOURCE_DIRECTORY_ENTRY = ^TImageResourceDirectoryEntry;
  _IMAGE_RESOURCE_DIRECTORY_ENTRY = packed record
    Name:DWORD;         { NameOffset:31,NameIsString:1 }
//    Id:WORD;
    OffsetToData:DWORD; { OffsetToDirectory:31,DataIsDirectory:1 }
  end;
  TImageResourceDirectoryEntry = _IMAGE_RESOURCE_DIRECTORY_ENTRY;

  PIMAGE_RESOURCE_DIRECTORY_STRING = ^TImageResourceDirectoryString;
  _IMAGE_RESOURCE_DIRECTORY_STRING = packed record
    Length:WORD;
    NameString:CHAR;
  end;
  TImageResourceDirectoryString = _IMAGE_RESOURCE_DIRECTORY_STRING;


  PIMAGE_RESOURCE_DIR_STRING_U = ^TImageResourceDirStringU;
  _IMAGE_RESOURCE_DIR_STRING_U = packed record
    Length:WORD;
    NameString:WCHAR;
  end;
  TImageResourceDirStringU = _IMAGE_RESOURCE_DIR_STRING_U;

  PIMAGE_RESOURCE_DATA_ENTRY = ^TImageResourceDataEntry;
  _IMAGE_RESOURCE_DATA_ENTRY = packed record
    OffsetToData:DWORD;
    Size:DWORD;
    CodePage:DWORD;
    Reserved:DWORD;
  end;
  TImageResourceDataEntry = _IMAGE_RESOURCE_DATA_ENTRY;

const
//  IMAGE_DOS_SIGNATURE    = $5A4D;       { MZ }
//  IMAGE_OS2_SIGNATURE    = $454E;       { NE }
//  IMAGE_OS2_SIGNATURE_LE = $454C;       { LE }
//  IMAGE_VXD_SIGNATURE    = $454C;       { LE }
//  IMAGE_NT_SIGNATURE     = $00004550;   { PE00 }

  IMAGE_SIZEOF_SHORT_NAME          = 8;
  IMAGE_SIZEOF_SECTION_HEADER      = 40;
  IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16;
  IMAGE_RESOURCE_NAME_IS_STRING    = $80000000;
  IMAGE_RESOURCE_DATA_IS_DIRECTORY = $80000000;
  IMAGE_OFFSET_STRIP_HIGH          = $7FFFFFFF;

  { File Characteristics }
  IMAGE_FILE_RELOCS_STRIPPED           = $0001;  // Relocation info stripped from file.
  IMAGE_FILE_EXECUTABLE_IMAGE          = $0002;  // File is executable  (i.e. no unresolved externel references).
  IMAGE_FILE_LINE_NUMS_STRIPPED        = $0004;  // Line nunbers stripped from file.
  IMAGE_FILE_LOCAL_SYMS_STRIPPED       = $0008;  // Local symbols stripped from file.
  IMAGE_FILE_AGGRESIVE_WS_TRIM         = $0010;  // Agressively trim working set
  IMAGE_FILE_LARGE_ADDRESS_AWARE       = $0020;  // App can handle >2gb addresses
  IMAGE_FILE_BYTES_REVERSED_LO         = $0080;  // Bytes of machine word are reversed.
  IMAGE_FILE_32BIT_MACHINE             = $0100;  // 32 bit word machine.
  IMAGE_FILE_DEBUG_STRIPPED            = $0200;  // Debugging info stripped from file in .DBG file
  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   = $0400;  // If Image is on removable media, copy and run from the swap file.
  IMAGE_FILE_NET_RUN_FROM_SWAP         = $0800;  // If Image is on Net, copy and run from the swap file.
  IMAGE_FILE_SYSTEM                    = $1000;  // System File.
  IMAGE_FILE_DLL                       = $2000;  // File is a DLL.
  IMAGE_FILE_UP_SYSTEM_ONLY            = $4000;  // File should only be run on a UP machine
  IMAGE_FILE_BYTES_REVERSED_HI         = $8000;  // Bytes of machine word are reversed.

  { Machine }
  IMAGE_FILE_MACHINE_UNKNOWN           = $0;