ufileinfo.pas

在delphi中实现windows核心编程.原书光盘代码核心编程.原书光盘代码

            NTHeader.OptionalHeader.MajorSubsystemVersion,
            NTHeader.OptionalHeader.MinorSubsystemVersion]));

      end;
      with items.add do
      begin
        caption := '代码段Code Section起始地址';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.BaseOfCode));
      end;
      with items.add do
      begin
        caption := '代码段Code Section的大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfCode));
      end;
      with items.add do
      begin
        caption := '数据段Data Section起始地址';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.BaseOfData));
      end;
      with items.add do
      begin
        caption := '已初始化数据块的大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfInitializedData));
      end;
      with items.add do
      begin
        caption := '未初始化数据块的大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfUninitializedData));
      end;
      with items.add do
      begin
        caption := '代码执行的起始地址';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.AddressOfEntryPoint));
      end;
      with items.add do
      begin
        caption := 'PE文件载入的地址';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.ImageBase));
      end;
      with items.add do
      begin
        caption := '节对齐值(节的大小自动扩展为它的倍数)';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SectionAlignment));
      end;
      with items.add do
      begin
        caption := '文件对齐值';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.FileAlignment));
      end;
      with items.add do
      begin
        caption := 'PE文件的大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfImage));
      end;
      with items.add do
      begin
        caption := '文件头及节表的大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfHeaders));
      end;
      with items.add do
      begin
        caption := '校验和';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.CheckSum));
      end;
      with items.add do
      begin
        case NTHeader.OptionalHeader.Subsystem of
          1: Str := '不需要子系统（例如驱动程序）';
          2: Str := '需要在Windows GUI子系统中运行';
          3: Str := '需要在Windows字元模式子系统中运行（也就是 console 应用程序）';
          5: Str := '需要在OS/2字元模式子系统中运行（也就是 OS/2 1.x 应用程序）';
          7: Str := '需要在Posix字元模式子系统中运行';
        else
          Str := '';
        end;
        caption := str;
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.Subsystem));
      end;
      with items.add do
      begin
        caption := 'DLL特征值';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.DllCharacteristics));
      end;
      with items.add do
      begin
        caption := '保留堆栈的大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfStackReserve));
      end;
      with items.add do
      begin
        caption := '提交的堆栈大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfStackCommit));
      end;
      with items.add do
      begin
        caption := '为局部Heap保留堆栈的大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfHeapReserve));
      end;
      with items.add do
      begin
        caption := '为局部Heap提交堆栈的大小';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.SizeOfHeapCommit));
      end;
      with items.add do
      begin
        caption := '数据目录的项数';
        subitems.add(formatvalue(8, NTHeader.OptionalHeader.NumberOfRvaAndSizes));
      end;
    finally
      Items.EndUpdate;
    end;
  end;
  DataDirectory.Items.Clear;
  for i := 0 to IMAGE_NUMBEROF_DIRECTORY_ENTRIES - 1 do
  begin
    case i of
      0: Str := 'Export Directory'; {导出表目录}
      1: Str := 'Import Directory'; {引入表目录}
      2: Str := 'Resource Directory'; {资源目录}
      3: Str := 'Exception Directory'; {异常目录}
      4: Str := 'Security Directory'; {验证目录}
      5: Str := 'Base Relocation Table'; {重入表}
      6: Str := 'Debug Directory'; {调试目录}
      7: Str := 'Description String'; {描述字符串}
      8: Str := 'Machine Value (MIPS GP)'; {机器值}
      9: Str := 'TLS Directory'; {TLS目录}
      10: Str := 'Load Configuration Directory'; {载入配置目录}
      11: Str := 'Bound Import Directory In Headers'; {文件头中的关联引入目录}
      12: Str := 'Import Address Table'; {引入地址表}
    else
      Str := 'UnUsed（保留）';
    end;
    with DataDirectory do
      with Items.Add do
      begin
        Caption := str;
        SubItems.Add(format('%8.x', [NTHeader.OptionalHeader.DataDirectory[i].VirtualAddress]));
        SubItems.Add(format('%8.x', [NTHeader.OptionalHeader.DataDirectory[i].Size]));
      end;
  end;
  for i:=Pagesection.PageCount-1 downto 0 do
  begin
     for j:=Pagesection.Pages[i].ControlCount-1 downto 0 do
        if Pagesection.Pages[i].Controls[j] is TListView then
           (Pagesection.Pages[i].Controls[j] as TListView).Free;
     with Pagesection.Pages[i] do
     begin
        PageControl:=nil;
        Free;
     end;
  end;
  for i := 0 to NTHeader.FileHeader.NumberOfSections - 1 do {遍历节表}
  begin
    {块表名}
    Setlength(Str,8);
    move(PESectionHeader[i].Name,Str[1],8);
    DirectorySection := TTabSheet.Create(Self);
    DirectorySection.PageControl := PageSection;
    DirectorySection.Caption := Str;
    Directorysection.Align := alClient;

    DataDirectoryList := TListView.Create(self);
    DataDirectoryList.parent := Directorysection;
    DataDirectoryList.Align := alClient;
    DataDirectoryList.ViewStyle := vsReport;
    DataDirectoryList.ReadOnly := true;
    DataDirectoryList.Columns.Add.Caption := '描述';
    DataDirectoryList.Columns.Add.Caption := '数据值';
    DataDirectoryList.Columns[0].Width := 400;
    DataDirectoryList.Columns[0].AutoSize:=true;
    DataDirectoryList.Columns[1].width := 400;
    with DataDirectoryList do
    begin
      try
        items.clear;
        items.BeginUpdate;
        with items.add do
        begin
          caption := '(在EXE中表示)虚拟空间大小或(在OBJ中表示)物理地址';
          subitems.add(formatvalue(8, PESectionHeader[i].Misc.VirtualSize));
        end;
        with items.add do
        begin
          caption := '节的重定位值';
          subitems.add(formatValue(8, PESectionHeader[i].VirtualAddress));
        end;
        with items.add do
        begin
          caption := '节的长度(经过节对齐)';
          subitems.add(formatvalue(8, PESectionHeader[i].SizeOfRawData));
        end;
        with items.add do
        begin
          caption := '节的数据在原文件中的实际地址';
          subitems.add(formatvalue(8, PESectionHeader[i].PointerToRawData));
        end;
        with items.add do
        begin
          caption := '(在OBJ中表示)节的重定位信息的地址';
          subitems.add(formatvalue(8, PESectionHeader[i].PointerToRelocations));
        end;
        with items.add do
        begin
          caption := '行号表的地址';
          subitems.add(formatvalue(8, PESectionHeader[i].PointerToLinenumbers));
        end;
        with items.add do
        begin
          caption := '(在OBJ中表示)重定位信息中重定位的个数';
          subitems.add(formatvalue(8, PESectionHeader[i].NumberOfRelocations));
        end;
        with items.add do
        begin
          caption := '行号表中行号的个数';
          subitems.add(formatvalue(8, PESectionHeader[i].NumberOfLinenumbers));
        end;
        with items.add do
        begin
          caption := '节的属性';
          subitems.add(formatvalue(8, PESectionHeader[i].Characteristics));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_CNT_CODE--$00000020(含代码)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_CNT_CODE, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_CNT_INITIALIZED_DATA--$00000040(含初始数据)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_CNT_INITIALIZED_DATA, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_CNT_UNINITIALIZED_DATA--$00000080(含未初始数据)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_CNT_UNINITIALIZED_DATA, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_LNK_INFO--$00000200(含文字说明或其他信息)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_LNK_INFO, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_LNK_REMOVE--$00000800(此块不被放入最终EXE文件中)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_LNK_REMOVE, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_LNK_COMDAT--$00001000(含COMDAT)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_LNK_COMDAT, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_LNK_NRELOC_OVFL--$01000000(含扩展重定位信息)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_LNK_NRELOC_OVFL, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_MEM_DISCARDABLE--$02000000(可丢弃)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_MEM_DISCARDABLE, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_MEM_NOT_CACHED--$04000000(不可隐藏)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_MEM_NOT_CACHED, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_MEM_NOT_PAGED--$08000000(不可分页)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_MEM_NOT_PAGED, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_MEM_SHARED--$10000000(可共享)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_MEM_SHARED, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_MEM_EXECUTE--$20000000(可执行)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_MEM_EXECUTE, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_MEM_READ--$40000000(可读)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_MEM_READ, PESectionHeader[i].Characteristics)));
        end;
        with items.add do
        begin
          caption := '  IMAGE_SCN_MEM_WRITE--$80000000(可写)';
          subitems.add(formatbool(checkvalue(IMAGE_SCN_MEM_WRITE, PESectionHeader[i].Characteristics)));
        end;
      finally
        items.EndUpdate;
      end;
    end;
  end;
end;

procedure TfrmFileInfo.SetFileName(value: string);
begin
  if FileExists(Value) then
  begin
    FFileName := Value;
    LoadPeInfo;
  end;
end;

procedure TfrmFileInfo.FormShow(Sender: TObject);
begin
  PageControl1.ActivePageIndex := 0;
  if FileExists(frmMain.fileName) then
     SetFileName(frmMain.FileName);
end;

procedure TfrmFileInfo.BitBtn2Click(Sender: TObject);
begin
  close;
end;

end.