unit1.pas

知道大家有没有用过PEDUMP

  IMAGE_FILE_MACHINE_I386              = $014c;  // Intel 386.
  IMAGE_FILE_MACHINE_R3000             = $0162;  // MIPS little-endian, $160 big-endian
  IMAGE_FILE_MACHINE_R4000             = $0166;  // MIPS little-endian
  IMAGE_FILE_MACHINE_R10000            = $0168;  // MIPS little-endian
  IMAGE_FILE_MACHINE_WCEMIPSV2         = $0169;  // MIPS little-endian WCE v2
  IMAGE_FILE_MACHINE_ALPHA             = $0184;  // Alpha_AXP
  IMAGE_FILE_MACHINE_SH3               = $01a2;  // SH3 little-endian
  IMAGE_FILE_MACHINE_SH3E              = $01a4;  // SH3E little-endian
  IMAGE_FILE_MACHINE_SH4               = $01a6;  // SH4 little-endian
  IMAGE_FILE_MACHINE_SH5               = $01a8;  // SH5
  IMAGE_FILE_MACHINE_ARM               = $01c0;  // ARM Little-Endian
  IMAGE_FILE_MACHINE_THUMB             = $01c2;
  IMAGE_FILE_MACHINE_ARM33             = $01d3;
  IMAGE_FILE_MACHINE_POWERPC           = $01F0;  // IBM PowerPC Little-Endian
  IMAGE_FILE_MACHINE_IA64              = $0200;  // Intel 64
  IMAGE_FILE_MACHINE_MIPS16            = $0266;  // MIPS
  IMAGE_FILE_MACHINE_ALPHA64           = $0284;  // ALPHA64
  IMAGE_FILE_MACHINE_MIPSFPU           = $0366;  // MIPS
  IMAGE_FILE_MACHINE_MIPSFPU16         = $0466;  // MIPS
//  IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
  IMAGE_FILE_MACHINE_AMD64             = $0500;  // AMD K8
  IMAGE_FILE_MACHINE_TRICORE           = $0520;  // Infineon
  IMAGE_FILE_MACHINE_CEF               = $0CEF;

  { Section characteristics }
//  IMAGE_SCN_TYPE_REG                   = $00000000;  // Reserved.
//  IMAGE_SCN_TYPE_DSECT                 = $00000001;  // Reserved.
//  IMAGE_SCN_TYPE_NOLOAD                = $00000002;  // Reserved.
//  IMAGE_SCN_TYPE_GROUP                 = $00000004;  // Reserved.
  IMAGE_SCN_TYPE_NO_PAD                = $00000008;  // Reserved.
//  IMAGE_SCN_TYPE_COPY                  = $00000010;  // Reserved.

  IMAGE_SCN_CNT_CODE                   = $00000020;  // Section contains code.
  IMAGE_SCN_CNT_INITIALIZED_DATA       = $00000040;  // Section contains initialized data.
  IMAGE_SCN_CNT_UNINITIALIZED_DATA     = $00000080;  // Section contains uninitialized data.

  IMAGE_SCN_LNK_OTHER                  = $00000100;  // Reserved.
  IMAGE_SCN_LNK_INFO                   = $00000200;  // Section contains comments or some other type of information.
//  IMAGE_SCN_TYPE_OVER                  = $00000400;  // Reserved.
  IMAGE_SCN_LNK_REMOVE                 = $00000800;  // Section contents will not become part of image.
  IMAGE_SCN_LNK_COMDAT                 = $00001000;  // Section contents comdat.
//                                       = $00002000;  // Reserved.
//  IMAGE_SCN_MEM_PROTECTED - Obsolete   = $00004000;
  IMAGE_SCN_NO_DEFER_SPEC_EXC          = $00004000;  // Reset speculative exceptions handling bits in the TLB entries for this section.
  IMAGE_SCN_GPREL                      = $00008000;  // Section content can be accessed relative to GP
  IMAGE_SCN_MEM_FARDATA                = $00008000;
//  IMAGE_SCN_MEM_SYSHEAP  - Obsolete    = $00010000;
  IMAGE_SCN_MEM_PURGEABLE              = $00020000;
  IMAGE_SCN_MEM_16BIT                  = $00020000;
  IMAGE_SCN_MEM_LOCKED                 = $00040000;
  IMAGE_SCN_MEM_PRELOAD                = $00080000;

  IMAGE_SCN_ALIGN_1BYTES               = $00100000;  //
  IMAGE_SCN_ALIGN_2BYTES               = $00200000;  //
  IMAGE_SCN_ALIGN_4BYTES               = $00300000;  //
  IMAGE_SCN_ALIGN_8BYTES               = $00400000;  //
  IMAGE_SCN_ALIGN_16BYTES              = $00500000;  // Default alignment if no others are specified.
  IMAGE_SCN_ALIGN_32BYTES              = $00600000;  //
  IMAGE_SCN_ALIGN_64BYTES              = $00700000;  //
  IMAGE_SCN_ALIGN_128BYTES             = $00800000;  //
  IMAGE_SCN_ALIGN_256BYTES             = $00900000;  //
  IMAGE_SCN_ALIGN_512BYTES             = $00A00000;  //
  IMAGE_SCN_ALIGN_1024BYTES            = $00B00000;  //
  IMAGE_SCN_ALIGN_2048BYTES            = $00C00000;  //
  IMAGE_SCN_ALIGN_4096BYTES            = $00D00000;  //
  IMAGE_SCN_ALIGN_8192BYTES            = $00E00000;  //
// Unused                                = $00F00000;
  IMAGE_SCN_ALIGN_MASK                 = $00F00000;

  IMAGE_SCN_LNK_NRELOC_OVFL            = $01000000;  // Section contains extended relocations.
  IMAGE_SCN_MEM_DISCARDABLE            = $02000000;  // Section can be discarded.
  IMAGE_SCN_MEM_NOT_CACHED             = $04000000;  // Section is not cachable.
  IMAGE_SCN_MEM_NOT_PAGED              = $08000000;  // Section is not pageable.
  IMAGE_SCN_MEM_SHARED                 = $10000000;  // Section is shareable.
  IMAGE_SCN_MEM_EXECUTE                = $20000000;  // Section is executable.
  IMAGE_SCN_MEM_READ                   = $40000000;  // Section is readable.
  IMAGE_SCN_MEM_WRITE                  = $80000000;  // Section is writeable.

var
  Form1: TForm1;

implementation

{$R *.DFM}

uses func, unit2;

procedure TForm1.ResetForm;
var
  i:Byte;
begin
  Dumped:=False;
  StatusBar1.Panels[1].Text:='';
  StatusBar1.Panels[2].Text:='';
  Caption:=Application.Title;
  for i:=1 to 15 do
  begin
    (FindComponent('cb_file_'+IntToStr(i)) as TCheckBox).Checked:=False;
  end;
  for i:=1 to 41 do
  begin
    (FindComponent('Edit_'+IntToStr(i)) as TEdit).Text:='';
    (FindComponent('Edit_'+IntToStr(i)) as TEdit).Hint:='';    
  end;
  while pc_Section.PageCount>0 do
  begin
    Application.ProcessMessages;
    pc_Section.Pages[pc_Section.PageCount-1].Free;
  end;
  lv_Directory.Items.Clear;
  TreeView1.Items.Clear;
  ProgressBar1.Position:=0;
end;

procedure TForm1.AddInfoToListView(ListView:TListView;Info1,Info2,Info3,Info4,Info5:String);
var
  ListItem:TListItem;
begin
  with ListView do
  begin
    ListItem:=Items.Add;
    ListItem.Caption:=Info1;
    ListItem.SubItems.Add(Info2);
    ListItem.SubItems.Add(Info3);
    ListItem.SubItems.Add(Info4);
    ListItem.SubItems.Add(Info5);
  end;
end;

function TForm1.CheckFileMachine(Value:Cardinal):String;
begin
  case Value of
//    IMAGE_FILE_MACHINE_UNKNOWN  :Result:='未知';
    IMAGE_FILE_MACHINE_I386     :Result:='Intel 386';
    $160                        :Result:='MIPS big-endian';
    IMAGE_FILE_MACHINE_R3000    :Result:='MIPS little-endian';
    IMAGE_FILE_MACHINE_R4000    :Result:='MIPS little-endian';
    IMAGE_FILE_MACHINE_R10000   :Result:='MIPS little-endian';
    IMAGE_FILE_MACHINE_WCEMIPSV2:Result:='MIPS little-endian WCE v2';
    IMAGE_FILE_MACHINE_ALPHA    :Result:='Alpha_AXP';
    IMAGE_FILE_MACHINE_SH3      :Result:='SH3 little-endian';
    IMAGE_FILE_MACHINE_SH3E     :Result:='SH3E little-endian';
    IMAGE_FILE_MACHINE_SH4      :Result:='SH4 little-endian';
    IMAGE_FILE_MACHINE_SH5      :Result:='SH5';
    IMAGE_FILE_MACHINE_ARM      :Result:='ARM Little-Endian';
    IMAGE_FILE_MACHINE_THUMB    :Result:='THUMB';
    IMAGE_FILE_MACHINE_ARM33    :Result:='ARM33';
    IMAGE_FILE_MACHINE_POWERPC  :Result:='IBM PowerPC Little-Endian';
    IMAGE_FILE_MACHINE_IA64     :Result:='Intel 64';
    IMAGE_FILE_MACHINE_MIPS16   :Result:='MIPS';
    IMAGE_FILE_MACHINE_ALPHA64  :Result:='ALPHA64';
    IMAGE_FILE_MACHINE_MIPSFPU  :Result:='MIPS';
    IMAGE_FILE_MACHINE_MIPSFPU16:Result:='MIPS';
//    IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
    IMAGE_FILE_MACHINE_AMD64    :Result:='AMD K8';
    IMAGE_FILE_MACHINE_TRICORE  :Result:='Infineon';
    IMAGE_FILE_MACHINE_CEF      :Result:='CEF';
    else Result:='未知';
  end;
end;

procedure TForm1.CheckFileCharacteristics(Value:Cardinal);
  function BeTrue(fg:Cardinal):Boolean;
  begin
    Result:=fg and not Value=0;
  end;
begin
  cb_file_1.Checked:=BeTrue(IMAGE_FILE_RELOCS_STRIPPED);
  cb_file_1.Hint:='$0001';
  cb_file_2.Checked:=BeTrue(IMAGE_FILE_EXECUTABLE_IMAGE);
  cb_file_2.Hint:='$0002';
  cb_file_3.Checked:=BeTrue(IMAGE_FILE_LINE_NUMS_STRIPPED);
  cb_file_3.Hint:='$0004';
  cb_file_4.Checked:=BeTrue(IMAGE_FILE_LOCAL_SYMS_STRIPPED);
  cb_file_4.Hint:='$0008';
  cb_file_5.Checked:=BeTrue(IMAGE_FILE_AGGRESIVE_WS_TRIM);
  cb_file_5.Hint:='$0010';
  cb_file_6.Checked:=BeTrue(IMAGE_FILE_LARGE_ADDRESS_AWARE);
  cb_file_6.Hint:='$0020';
  cb_file_7.Checked:=BeTrue(IMAGE_FILE_BYTES_REVERSED_LO);
  cb_file_7.Hint:='$0080';
  cb_file_8.Checked:=BeTrue(IMAGE_FILE_32BIT_MACHINE);
  cb_file_8.Hint:='$0100';
  cb_file_9.Checked:=BeTrue(IMAGE_FILE_DEBUG_STRIPPED);
  cb_file_9.Hint:='$0200';
  cb_file_10.Checked:=BeTrue(IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP);
  cb_file_10.Hint:='$0400';
  cb_file_11.Checked:=BeTrue(IMAGE_FILE_NET_RUN_FROM_SWAP);
  cb_file_11.Hint:='$0800';
  cb_file_12.Checked:=BeTrue(IMAGE_FILE_SYSTEM);
  cb_file_12.Hint:='$1000';
  cb_file_13.Checked:=BeTrue(IMAGE_FILE_DLL);
  cb_file_13.Hint:='$2000';
  cb_file_14.Checked:=BeTrue(IMAGE_FILE_UP_SYSTEM_ONLY);
  cb_file_14.Hint:='$4000';
  cb_file_15.Checked:=BeTrue(IMAGE_FILE_BYTES_REVERSED_HI);
  cb_file_15.Hint:='$8000';
end;

function TForm1.AddValue(W:Byte;Value:Cardinal):String;
begin
  Result:='';
  if W=4 then
    Result:=Format('    %.4x  [%u]',[Value,Value]);
  if W=8 then
    Result:=Format('%.8x  [%u]',[Value,Value]);
end;

function TForm1.CheckResourceType(W:Byte):String;
begin
  case W of
    0: Result:='UNKNOWN0';
    1: Result:='CURSOR_ENTRY';
    2: Result:='BITMAP';
    3: Result:='ICON_ENTRY';
    4: Result:='MENU';
    5: Result:='DIALOG';
    6: Result:='STRING';
    7: Result:='FONT_DIR';
    8: Result:='FONT';
    9: Result:='ACCELERATORS';
    10: Result:='RCDATA';
    11: Result:='MESSAGE_TABLE';
    13: Result:='UNKNOW13';
    12: Result:='CURSOR';
    14: Result:='ICON';
    15: Result:='UNKNOW15';
    16: Result:='VERSION';// INFORMATION';
    else
      Result:='UNKNOW';
  end;
end;

procedure TForm1.CreateSectionTabSheet(SectionIndex:Integer;title:String;
  info1,info2,info3,info4,info5,
  info6,info7,info8,info9,info10:Cardinal);
  function BeTrue(fg:Cardinal):Boolean;
  begin
    Result:=fg and not info10=0;
  end;
var
  ts_Section:TTabSheet;
  gb_Section:TGroupBox;
  bl_Section:TBevel;
  stt_Section:array[0..9]of TStaticText;
  Edit_Section:array[0..9]of TEdit;
  cb_Section:array[0..13]of TCheckBox;
  i:Byte;
begin
  ts_Section:=TTabSheet.Create(Self);
  ts_Section.PageControl:=pc_Section;
  ts_Section.Caption:=title;
  bl_Section:=TBevel.Create(Self);
  bl_Section.Parent:=ts_Section;
  bl_Section.Shape:=bsBottomLine;
  bl_Section.Top:=183;
  bl_Section.Left:=16;
  bl_Section.Height:=10;
  bl_Section.Width:=241;
  gb_Section:=TGroupBox.Create(Self);
  gb_Section.Parent:=ts_Section;
  gb_Section.Caption:='属性详解';
  gb_Section.Top:=8;
  gb_Section.Left:=272;
  gb_Section.Width:=257;
  gb_Section.Height:=185;
  for i:=0 to 9 do
  begin
    stt_Section[i]:=TStaticText.Create(Self);
    stt_Section[i].Name:=Format('StaticText_%u_%u',[SectionIndex,i]);
    stt_Section[i].Parent:=ts_Section;
    stt_Section[i].Left:=16;
    stt_Section[i].Top:=16*i+16;
    stt_Section[i].ShowHint:=True;

    Edit_Section[i]:=TEdit.Create(Self);
    Edit_Section[i].Name:=Format('Edit_%u_%u',[SectionIndex,i]);
    Edit_Section[i].Parent:=ts_Section;
    Edit_Section[i].BorderStyle:=bsNone;
    Edit_Section[i].ReadOnly:=True;
    Edit_Section[i].AutoSelect:=False;
    Edit_Section[i].Left:=120;
    Edit_Section[i].Top:=16*i+16;
    Edit_Section[i].Width:=137;
    Edit_Section[i].Height:=12;
    Edit_Section[i].Color:=clSilver;
    Edit_Section[i].ShowHint:=True;
  end;
  stt_Section[0].Caption:='物理地址：';
  stt_Section[0].Hint:='Misc.PhysicalAddress';
  stt_Section[1].Caption:='真实地址：';
  stt_Section[1].Hint:='Misc.VirtualSize';
  stt_Section[2].Caption:='节RVA：';
  stt_Section[2].Hint:='VirtualAddress';
  stt_Section[3].Caption:='节物理长度：';
  stt_Section[3].Hint:='SizeOfRawData';
  stt_Section[4].Caption:='节物理偏移：';
  stt_Section[4].Hint:='PointerToRawData';
  stt_Section[5].Caption:='重定位偏移：';
  stt_Section[5].Hint:='PointerToRelocations';
  stt_Section[6].Caption:='行号表偏移：';
  stt_Section[6].Hint:='PointerToLinenumbers';
  stt_Section[7].Caption:='重定位项目个数：';
  stt_Section[7].Hint:='NumberOfRelocations';
  stt_Section[8].Caption:='行号表行号个数：';
  stt_Section[8].Hint:='NumberOfLinenumbers';
  stt_Section[9].Caption:='节属性：';
  stt_Section[9].Hint:='Characteristics';
  for i:=0 to 13 do
  begin
    cb_Section[i]:=TCheckBox.Create(Self);
    cb_Section[i].Name:=Format('CheckBox_%u_%u',[SectionIndex,i]);
    cb_Section[i].Parent:=gb_Section;
    cb_Section[i].ShowHint:=True;
    if i<7 then
    begin
      cb_Section[i].Left:=8;
      cb_Section[i].Top:=16*(i+1);
      cb_Section[i].Width:=153;
    end else
    begin
      cb_Section[i].Left:=128;
      cb_Section[i].Top:=16*(i-3);
      cb_Section[i].Width:=113;
    end;
  end;

  Edit_Section[0].Text:=AddValue(8,info1);
  Edit_Section[0].Hint:='在OBJ中表示Section的实际地址';
  Edit_Section[1].Text:=AddValue(8,info2);
  Edit_Section[1].Hint:='在EXE中表示Code Section或Data Section的虚拟大小';
  Edit_Section[2].Text:=AddValue(8,info3);
  Edit_Section[2].Hint:='在EXE中，表示Section映射的RVA位置'+#13
                       +'在OBJ中，此位无实际意义，总为0';
  Edit_Section[3].Text:=AddValue(8,info4);
  Edit_Section[3].Hint:='在EXE中，表示Section对齐后的值'+#13
                       +'在OBJ中，表示Section的真实大小';