API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Aug 13th, 2018
390
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PureBasic 91.94 KB | None | 0 0
raw download clone embed print report
  1. EnableExplicit
  2.  
  3. ;By Celtic88 ;)
  4.  
  5. #IMAGE_RESOURCE_NAME_IS_STRING     =$80000000
  6. #IMAGE_RESOURCE_DATA_IS_DIRECTORY     =$80000000
  7.  
  8. ;IMAGE_DOS_HEADER\e_magic
  9. #IMAGE_DOS_HEADER=$5A4D;Magic number
  10.  
  11. ;IMAGE_NT_HEADERS\Signature
  12. #IMAGE_NT_SIGNATURE=$00004550;signature
  13.  
  14. ;IMAGE_FILE_HEADER\Machine
  15. #IMAGE_FILE_MACHINE_I386=$014c;x86
  16. #IMAGE_FILE_MACHINE_IA64=$0200;Intel Itanium
  17. #IMAGE_FILE_MACHINE_AMD64=$8664;x64
  18.  
  19. ;IMAGE_NT_HEADERS\FileHeader\Characteristics
  20. #IMAGE_FILE_RELOCS_STRIPPED=$0001;Relocation information was stripped from the file. The file must be loaded at its preferred base address. If the base address is not available, the loader reports an error.
  21. #IMAGE_FILE_EXECUTABLE_IMAGE=$0002;The file is executable (there are no unresolved external references).
  22. #IMAGE_FILE_LINE_NUMS_STRIPPED=$0004;COFF line numbers were stripped from the file.
  23. #IMAGE_FILE_LOCAL_SYMS_STRIPPED=$0008;COFF symbol table entries were stripped from file.
  24. #IMAGE_FILE_AGGRESIVE_WS_TRIM=$0010  ;Aggressively trim the working set. This value is obsolete.
  25. #IMAGE_FILE_LARGE_ADDRESS_AWARE=$0020;The application can handle addresses larger than 2 GB.
  26. #IMAGE_FILE_BYTES_REVERSED_LO=$0080  ;The bytes of the word are reversed. This flag is obsolete.
  27. #IMAGE_FILE_32BIT_MACHINE=$0100      ;The computer supports 32-bit words.
  28. #IMAGE_FILE_DEBUG_STRIPPED=$0200     ;Debugging information was removed and stored separately in another file.
  29. #IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP=$0400;If the image is on removable media, copy it to and run it from the swap file.
  30. #IMAGE_FILE_NET_RUN_FROM_SWAP=$0800      ;If the image is on the network, copy it to and run it from the swap file.
  31. #IMAGE_FILE_SYSTEM=$1000                 ;The image is a system file.
  32. #IMAGE_FILE_DLL=$2000                    ;The image is a DLL file. While it is an executable file, it cannot be run directly.
  33. #IMAGE_FILE_UP_SYSTEM_ONLY=$4000         ;The file should be run only on a uniprocessor computer.
  34. #IMAGE_FILE_BYTES_REVERSED_HI=$8000      ;The bytes of the word are reversed. This flag is obsolete.
  35.  
  36. ;IMAGE_NT_HEADERS\OptionalHeader\Magic
  37. #IMAGE_NT_OPTIONAL_HDR32_MAGIC = $10B;32-bit application
  38. #IMAGE_NT_OPTIONAL_HDR64_MAGIC = $20B;64-bit application
  39. #IMAGE_ROM_OPTIONAL_HDR_MAGIC = $107 ;ROM image
  40.  
  41. ;IMAGE_NT_HEADERS\OptionalHeader\Subsystem
  42. #IMAGE_SUBSYSTEM_UNKNOWN = 0;Unknown subsystem.
  43. #IMAGE_SUBSYSTEM_NATIVE = 1 ;No subsystem required (device drivers and native system processes).
  44. #IMAGE_SUBSYSTEM_WINDOWS_GUI = 2;Windows graphical user interface (GUI) subsystem.
  45. #IMAGE_SUBSYSTEM_WINDOWS_CUI = 3;Windows character-mode user interface (CUI) subsystem.
  46. #IMAGE_SUBSYSTEM_OS2_CUI = 5    ;OS/2 CUI subsystem.
  47. #IMAGE_SUBSYSTEM_POSIX_CUI = 7  ;POSIX CUI subsystem.
  48. #IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9;Windows CE system.
  49. #IMAGE_SUBSYSTEM_EFI_APPLICATION = 10;Extensible Firmware Interface (EFI) application.
  50. #IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11;EFI driver with boot services.
  51. #IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12     ;EFI driver with run-time services.
  52. #IMAGE_SUBSYSTEM_EFI_ROM = 13                ;EFI ROM image.
  53. #IMAGE_SUBSYSTEM_XBOX = 14                   ;Xbox system.
  54. #IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 16;Boot application.
  55.  
  56. ;IMAGE_NT_HEADERS\OptionalHeader\DllCharacteristics
  57. #IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE=$0040;The DLL can be relocated at load time.
  58. #IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY=$0080;Code integrity checks are forced. If you set this flag and a section contains only uninitialized data, set the PointerToRawData member of #IMAGE_SECTION_HEADER for that section to zero; otherwise, the image will fail to load because the digital signature cannot be verified.
  59. #IMAGE_DLLCHARACTERISTICS_NX_COMPAT=$0100      ;The image is compatible with data execution prevention (DEP).
  60. #IMAGE_DLLCHARACTERISTICS_NO_ISOLATION=$0200   ;The image is isolation aware, but should not be isolated.
  61. #IMAGE_DLLCHARACTERISTICS_NO_SEH=$0400         ;The image does not use structured exception handling (SEH). No handlers can be called in this image.
  62. #IMAGE_DLLCHARACTERISTICS_NO_BIND=$0800        ;Do not bind the image
  63. #IMAGE_DLLCHARACTERISTICS_WDM_DRIVER=$2000     ;A WDM driver
  64. #IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE=$8000;The image is terminal server aware.
  65.  
  66. ;IMAGE_NT_HEADERS\OptionalHeader\DllCharacteristics
  67. #IMAGE_DIRECTORY_ENTRY_EXPORT = 0
  68. #IMAGE_DIRECTORY_ENTRY_IMPORT = 1
  69. #IMAGE_DIRECTORY_ENTRY_RESOURCE   = 2
  70. #IMAGE_DIRECTORY_ENTRY_EXCEPTION = 3
  71. #IMAGE_DIRECTORY_ENTRY_SECURITY   = 4
  72. #IMAGE_DIRECTORY_ENTRY_BASERELOC = 5
  73. #IMAGE_DIRECTORY_ENTRY_DEBUG = 6
  74. #IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7
  75. #IMAGE_DIRECTORY_ENTRY_ARCHITECTURE   = 7
  76. #IMAGE_DIRECTORY_ENTRY_GLOBALPTR = 8
  77. #IMAGE_DIRECTORY_ENTRY_TLS = 9
  78. #IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG = 10
  79. #IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   = 11
  80. #IMAGE_DIRECTORY_ENTRY_IAT = 12
  81. #IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   = 13
  82. #IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR = 14
  83.  
  84. #IMAGE_ORDINAL_FLAG = $80000000
  85. #IMAGE_ORDINAL_FLAGx64=$8000000000000000
  86.  
  87. #IMAGE_SCN_CNT_CODE = $00000020
  88. #IMAGE_SCN_CNT_INITIALIZED_DATA = $00000040
  89. #IMAGE_SCN_CNT_UNINITIALIZED_DATA = $00000080
  90. #IMAGE_SCN_MEM_SHARED = $10000000
  91. #IMAGE_SCN_MEM_EXECUTE = $20000000
  92. #IMAGE_SCN_MEM_READ = $40000000
  93. #IMAGE_SCN_MEM_WRITE = $80000000
  94.  
  95. #IMAGE_REL_BASED_ABSOLUTE = 0
  96. #IMAGE_REL_BASED_HIGH = 1
  97. #IMAGE_REL_BASED_LOW = 2
  98. #IMAGE_REL_BASED_HIGHLOW = 3
  99. #IMAGE_REL_BASED_HIGHADJ = 4
  100. #IMAGE_REL_BASED_MIPS_JMPADDR = 5
  101. #IMAGE_REL_BASED_DIR64 = 10
  102.  
  103. Structure IMAGE_IMPORT_DESCRIPTOR ; from winnt.h
  104.   OriginalFirstThunk.l    
  105.   TimeDateStamp.l
  106.   ForwarderChain.l
  107.   Name.l
  108.   FirstThunk.l
  109. EndStructure
  110.  
  111. Structure IMAGE_THUNK_DATA32 ; from winnt.h
  112.   StructureUnion
  113.     ForwarderString.l
  114.     Function.l
  115.     Ordinal.l
  116.     AddressOfData.l
  117.   EndStructureUnion      
  118. EndStructure
  119.  
  120. Structure IMAGE_THUNK_DATA64 ; from winnt.h
  121.   StructureUnion
  122.     ForwarderString.q
  123.     Function.q
  124.     Ordinal.q
  125.     AddressOfData.q
  126.   EndStructureUnion      
  127. EndStructure
  128.  
  129. Structure IMAGE_RESOURCE_DIRECTORY
  130.   Characteristics.l;
  131.   TimeDateStamp.l  ;
  132.   MajorVersion.w   ;
  133.   MinorVersion.w   ;
  134.   NumberOfNamedEntries.w;
  135.   NumberOfIdEntries.w   ;
  136. EndStructure
  137.  
  138. Structure IMAGE_RESOURCE_DIRECTORY_ENTRY
  139.   NameOffset.l;
  140.   OffsetToData.l;
  141. EndStructure
  142.  
  143. Structure IMAGE_RESOURCE_DATA_ENTRY
  144.   OffsetToData.l;
  145.   Size.l        ;
  146.   CodePage.l    ;
  147.   Reserved.l    ;
  148. EndStructure
  149.  
  150. Structure IMAGE_RESOURCE_DIRECTORY_STRING
  151.   Length.u
  152.   ;   NameString.a[1]
  153. EndStructure
  154.  
  155. Structure ImportFunctionList
  156.   IMAGE_THUNK_DATA.q
  157.   Ordinal.q
  158.   FunctionName.s
  159. EndStructure
  160.  
  161. Structure IMAGE_BASE_RELOCATION ; from winnt.h
  162.   VirtualAddress.l
  163.   SizeOfBlock.l
  164. EndStructure
  165.  
  166. Structure IMAGE_IMPORT_DESCRIPTORList Extends IMAGE_IMPORT_DESCRIPTOR
  167.   LibraryName.s; name of imported dll
  168.   List ImportFunctionList.ImportFunctionList() ;list of imported function
  169. EndStructure
  170.  
  171. Structure IMAGE_IMPORT_DESCRIPTORInfo
  172.   List IMAGE_IMPORT_DESCRIPTORList.IMAGE_IMPORT_DESCRIPTORList()
  173. EndStructure
  174.  
  175. Structure ExportFunctionNameListe
  176.   FunctionName.s ; Function Name
  177.   FunctionAddress.l ; Function Address
  178.   Ordinale.w ; Function Ordinale
  179. EndStructure
  180.  
  181. Structure IMAGE_EXPORT_DIRECTORYInfo Extends IMAGE_EXPORT_DIRECTORY
  182.   __File_OriginalDllName.s ;original dll name
  183.   List ExportFunctionNameListe.ExportFunctionNameListe()
  184. EndStructure
  185.  
  186. Structure ResourceSubDirectoryList Extends IMAGE_RESOURCE_DIRECTORY
  187.   __File_ResourceDirectoryName.s; Resource Directory Name
  188.   __File_ResourceDirectoryID.l;Resource Directory ID
  189.   __File_ResourceOffset.l;Resource Offset
  190.   OffsetToData.l;
  191.   Size.l        ;
  192.   CodePage.l    ;
  193. EndStructure
  194.  
  195. Structure ResourceDirectoryList Extends IMAGE_RESOURCE_DIRECTORY
  196.   __File_ResourceDirectoryName.s
  197.   __File_ResourceDirectoryID.l
  198.   __File_ResourceSubDirectoryCount.l
  199.   List ResourceSubDirectoryList.ResourceSubDirectoryList()
  200. EndStructure
  201.  
  202. Structure IMAGE_RESOURCE_DIRECTORYInfo Extends IMAGE_RESOURCE_DIRECTORY
  203.   __File_ResourceDirectoryCount.l; number of Resource
  204.   List ResourceDirectoryList.ResourceDirectoryList()
  205. EndStructure
  206.  
  207. Structure IMAGE_SECTION_HEADERInfo Extends IMAGE_SECTION_HEADER
  208.   __File_Selction_Name.s ; pe section name
  209. EndStructure
  210.  
  211. Structure IMAGE_BASE_RELOCATIONInfo Extends IMAGE_BASE_RELOCATION
  212.   List RelocationTypeList.unicode() ; Relocation
  213. EndStructure
  214.  
  215. Structure PB_PEExplorer
  216.   __File_OffsetEntryCode.l ; start code offset
  217.   __File_ImageSize.l
  218.   IMAGE_DOS_HEADER.IMAGE_DOS_HEADER
  219.   IMAGE_NT_HEADERS64.IMAGE_NT_HEADERS64
  220.   IMAGE_NT_HEADERS32.IMAGE_NT_HEADERS32
  221.   List IMAGE_SECTION_HEADERList.IMAGE_SECTION_HEADERInfo()
  222.   IMAGE_IMPORT_DESCRIPTORInfo.IMAGE_IMPORT_DESCRIPTORInfo
  223.   IMAGE_EXPORT_DIRECTORYInfo.IMAGE_EXPORT_DIRECTORYInfo
  224.   IMAGE_RESOURCE_DIRECTORYInfo.IMAGE_RESOURCE_DIRECTORYInfo
  225.   List IMAGE_BASE_RELOCATIONList.IMAGE_BASE_RELOCATIONInfo()
  226. EndStructure
  227.  
  228. Macro Resource_IsNameString(NameOffset);Gets a value indicating whether the directory name is a string.
  229.   (NameOffset & $80000000)
  230. EndMacro
  231.  
  232. Macro Resource_NameAddress(NameOffset);Gets an offset, relative to the beginning of the resource directory of the string, which is of type
  233.   (NameOffset & $7FFFFFFF)
  234. EndMacro
  235.  
  236. Macro Resource_IsDirectory(OffsetToData);Gets a value indicating whether the entry is a directory.
  237.   (OffsetToData & $80000000)
  238. EndMacro
  239.  
  240. Macro Resource_DirectoryAddress(OffsetToData);Offset to the child <see cref="IMAGE_RESOURCE_DIRECTORY"/> or <see cref="IMAGE_RESOURCE_DATA_ENTRY"/>
  241.   (OffsetToData & $7FFFFFFF)
  242. EndMacro
  243.  
  244. Macro Resource_IsDataEntry(tOffset);Gets a value indicating whether the child structure is a <see cref="IMAGE_RESOURCE_DATA_ENTRY"/> structure.
  245.   Resource_IsNameString(tOffset) And Resource_IsDirectory(tOffset)
  246. EndMacro
  247.  
  248. Procedure Pb_PEExplorer(PeFile_ID ,*iPB_PEExplorer.PB_PEExplorer); Get Pe info
  249.   Protected tIMAGE_DOS_HEADER.IMAGE_DOS_HEADER
  250.   Protected tIMAGE_NT_HEADERS64.IMAGE_NT_HEADERS64
  251.   Protected tIMAGE_NT_HEADERS32.IMAGE_NT_HEADERS32
  252.   Protected tIMAGE_SECTION_HEADER.IMAGE_SECTION_HEADER
  253.   Protected tIMAGE_IMPORT_DESCRIPTOR.IMAGE_IMPORT_DESCRIPTOR
  254.   Protected tIMAGE_THUNK_DATA32.IMAGE_THUNK_DATA32
  255.   Protected tIMAGE_THUNK_DATA64.IMAGE_THUNK_DATA64
  256.   Protected tIMAGE_EXPORT_DIRECTORY.IMAGE_EXPORT_DIRECTORY
  257.   Protected tIMAGE_RESOURCE_DIRECTORY.IMAGE_RESOURCE_DIRECTORY
  258.   Protected tIMAGE_RESOURCE_DIRECTORY_ENTRY.IMAGE_RESOURCE_DIRECTORY_ENTRY
  259.   Protected tIMAGE_RESOURCE_DIRECTORY_STRING.IMAGE_RESOURCE_DIRECTORY_STRING
  260.   Protected tChildIMAGE_RESOURCE_DIRECTORY.IMAGE_RESOURCE_DIRECTORY
  261.   Protected tChildIMAGE_RESOURCE_DIRECTORY_ENTRY.IMAGE_RESOURCE_DIRECTORY_ENTRY
  262.   Protected tChildI1MAGE_RESOURCE_DIRECTORY.IMAGE_RESOURCE_DIRECTORY
  263.   Protected tChild1IMAGE_RESOURCE_DIRECTORY_ENTRY.IMAGE_RESOURCE_DIRECTORY_ENTRY
  264.   Protected tIMAGE_RESOURCE_DATA_ENTRY.IMAGE_RESOURCE_DATA_ENTRY
  265.   Protected tIMAGE_BASE_RELOCATION.IMAGE_BASE_RELOCATION,offsetReloc
  266.   Protected.l i,inct,incid,incrd,o,z,ii.w,itr
  267.  
  268.   FileSeek(PeFile_ID,0)  
  269.   ReadData(PeFile_ID,@tIMAGE_DOS_HEADER,SizeOf(IMAGE_DOS_HEADER));get IMAGE_DOS_HEADER
  270.   If tIMAGE_DOS_HEADER\e_magic <> #IMAGE_DOS_HEADER:ProcedureReturn 0:EndIf
  271.   CopyMemory(@tIMAGE_DOS_HEADER,@*iPB_PEExplorer\IMAGE_DOS_HEADER,SizeOf(IMAGE_DOS_HEADER))
  272.  
  273.   FileSeek(PeFile_ID,tIMAGE_DOS_HEADER\e_lfanew)
  274.   ReadData(PeFile_ID,@tIMAGE_NT_HEADERS32,SizeOf(IMAGE_NT_HEADERS32));get IMAGE_NT_HEADERS
  275.   If tIMAGE_NT_HEADERS32\Signature <> #IMAGE_NT_SIGNATURE:ProcedureReturn 0:EndIf
  276.   CopyMemory(@tIMAGE_NT_HEADERS32,@*iPB_PEExplorer\IMAGE_NT_HEADERS32,SizeOf(IMAGE_NT_HEADERS32))
  277.  
  278.   Protected ImportVirtualAddress.l=tIMAGE_NT_HEADERS32\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_IMPORT]\VirtualAddress
  279.   Protected ExportVirtualAddress.l= tIMAGE_NT_HEADERS32\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_EXPORT]\VirtualAddress
  280.   Protected ResourceVirtualAddress.l= tIMAGE_NT_HEADERS32\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_RESOURCE]\VirtualAddress
  281.   Protected RelocVirtualAddress.l= tIMAGE_NT_HEADERS32\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_BASERELOC]\VirtualAddress
  282.  
  283.   Protected endOfImage.l
  284.  
  285.   Protected IMAGE_ORDINAL_FLAG.q = #IMAGE_ORDINAL_FLAG,SizeIMAGE_NT_HEADERS.l = SizeOf(IMAGE_NT_HEADERS32),SizeIMAGE_THUNK_DATA.l=SizeOf(IMAGE_THUNK_DATA32)
  286.   If tIMAGE_NT_HEADERS32\OptionalHeader\Magic  = #IMAGE_NT_OPTIONAL_HDR64_MAGIC
  287.     IMAGE_ORDINAL_FLAG = #IMAGE_ORDINAL_FLAGx64
  288.     FileSeek(PeFile_ID,tIMAGE_DOS_HEADER\e_lfanew)
  289.     ReadData(PeFile_ID,@tIMAGE_NT_HEADERS64,SizeOf(IMAGE_NT_HEADERS64))
  290.     CopyMemory(@tIMAGE_NT_HEADERS64,@*iPB_PEExplorer\IMAGE_NT_HEADERS64,SizeOf(IMAGE_NT_HEADERS64))
  291.     SizeIMAGE_NT_HEADERS = SizeOf(IMAGE_NT_HEADERS64)
  292.     SizeIMAGE_THUNK_DATA = SizeOf(IMAGE_THUNK_DATA64)
  293.     ImportVirtualAddress = tIMAGE_NT_HEADERS64\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_IMPORT]\VirtualAddress
  294.     ExportVirtualAddress = tIMAGE_NT_HEADERS64\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_EXPORT]\VirtualAddress
  295.     ResourceVirtualAddress = tIMAGE_NT_HEADERS64\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_RESOURCE]\VirtualAddress
  296.     RelocVirtualAddress = tIMAGE_NT_HEADERS64\OptionalHeader\DataDirectory[#IMAGE_DIRECTORY_ENTRY_BASERELOC]\VirtualAddress
  297.   EndIf
  298.   Protected tIMAGE_THUNK_DATA.Quad,iInitialOffset.l
  299.  
  300.   For i=0 To (tIMAGE_NT_HEADERS32\FileHeader\NumberOfSections-1);get all pe sections
  301.     FileSeek(PeFile_ID,tIMAGE_DOS_HEADER\e_lfanew+SizeIMAGE_NT_HEADERS+ (SizeOf(IMAGE_SECTION_HEADER)*i))
  302.     ReadData(PeFile_ID,@tIMAGE_SECTION_HEADER,SizeOf(IMAGE_SECTION_HEADER))
  303.     With tIMAGE_SECTION_HEADER
  304.       If \VirtualAddress
  305.         AddElement(*iPB_PEExplorer\IMAGE_SECTION_HEADERList())
  306.         CopyMemory(@tIMAGE_SECTION_HEADER,@*iPB_PEExplorer\IMAGE_SECTION_HEADERList(),SizeOf(IMAGE_SECTION_HEADER))
  307.         *iPB_PEExplorer\IMAGE_SECTION_HEADERList()\__File_Selction_Name = PeekS(@\SecName,8,#PB_Ascii)
  308.        
  309.         If *iPB_PEExplorer\__File_ImageSize < \PointerToRawData+\SizeOfRawData:*iPB_PEExplorer\__File_ImageSize= \PointerToRawData+\SizeOfRawData:EndIf
  310.        
  311.         If tIMAGE_NT_HEADERS32\OptionalHeader\Magic  = #IMAGE_NT_OPTIONAL_HDR64_MAGIC
  312.           If \VirtualAddress <= tIMAGE_NT_HEADERS64\OptionalHeader\AddressOfEntryPoint And tIMAGE_NT_HEADERS64\OptionalHeader\AddressOfEntryPoint < \VirtualAddress + \SizeOfRawData
  313.             *iPB_PEExplorer\__File_OffsetEntryCode=( tIMAGE_NT_HEADERS64\OptionalHeader\AddressOfEntryPoint-\VirtualAddress)+\PointerToRawData;file offset to entry code
  314.           EndIf            
  315.         Else
  316.           If \VirtualAddress <= tIMAGE_NT_HEADERS32\OptionalHeader\AddressOfEntryPoint And tIMAGE_NT_HEADERS32\OptionalHeader\AddressOfEntryPoint < \VirtualAddress + \SizeOfRawData
  317.             *iPB_PEExplorer\__File_OffsetEntryCode=( tIMAGE_NT_HEADERS32\OptionalHeader\AddressOfEntryPoint-\VirtualAddress)+\PointerToRawData;file offset to entry code
  318.           EndIf
  319.         EndIf
  320.        
  321.         If \VirtualAddress <= ImportVirtualAddress And \VirtualAddress+ \VirtualSize > ImportVirtualAddress ;import library address
  322.           FileSeek(PeFile_ID,( ImportVirtualAddress-\VirtualAddress)+\PointerToRawData)
  323.           ReadData(PeFile_ID,@tIMAGE_IMPORT_DESCRIPTOR,SizeOf(IMAGE_IMPORT_DESCRIPTOR))          
  324.           While  tIMAGE_IMPORT_DESCRIPTOR\FirstThunk
  325.             FileSeek(PeFile_ID,tIMAGE_IMPORT_DESCRIPTOR\Name -(\VirtualAddress - \PointerToRawData))
  326.             AddElement(*iPB_PEExplorer\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList())
  327.             CopyMemory(@tIMAGE_IMPORT_DESCRIPTOR,@*iPB_PEExplorer\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList(),SizeOf(IMAGE_IMPORT_DESCRIPTOR))
  328.             *iPB_PEExplorer\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\LibraryName = ReadString(PeFile_ID); set library name
  329.             iInitialOffset=tIMAGE_IMPORT_DESCRIPTOR\FirstThunk            
  330.             If tIMAGE_IMPORT_DESCRIPTOR\OriginalFirstThunk
  331.               iInitialOffset=tIMAGE_IMPORT_DESCRIPTOR\OriginalFirstThunk
  332.             EndIf
  333.             FileSeek(PeFile_ID,iInitialOffset -(\VirtualAddress - \PointerToRawData))
  334.             ReadData(PeFile_ID,@tIMAGE_THUNK_DATA,SizeIMAGE_THUNK_DATA)
  335.             inct=0
  336.             While tIMAGE_THUNK_DATA\q
  337.               AddElement(*iPB_PEExplorer\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList())
  338.               If tIMAGE_THUNK_DATA\q & IMAGE_ORDINAL_FLAG
  339.                 *iPB_PEExplorer\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\Ordinal = tIMAGE_THUNK_DATA\q;is a ordinal function
  340.               Else
  341.                 FileSeek(PeFile_ID,((tIMAGE_THUNK_DATA\q +2)-(\VirtualAddress - \PointerToRawData)))
  342.                 *iPB_PEExplorer\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\FunctionName = ReadString(PeFile_ID);get function name
  343.               EndIf
  344.               *iPB_PEExplorer\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\IMAGE_THUNK_DATA=tIMAGE_THUNK_DATA\q
  345.               inct + SizeIMAGE_THUNK_DATA
  346.               FileSeek(PeFile_ID,(iInitialOffset -(\VirtualAddress - \PointerToRawData))+inct)
  347.               ReadData(PeFile_ID,@tIMAGE_THUNK_DATA,SizeIMAGE_THUNK_DATA)
  348.             Wend
  349.             incid+ SizeOf(IMAGE_IMPORT_DESCRIPTOR)
  350.             FileSeek(PeFile_ID,(( ImportVirtualAddress-\VirtualAddress)+\PointerToRawData)+incid)
  351.             ReadData(PeFile_ID,@tIMAGE_IMPORT_DESCRIPTOR,SizeOf(IMAGE_IMPORT_DESCRIPTOR))
  352.           Wend
  353.         EndIf
  354.        
  355.         If \VirtualAddress <= ExportVirtualAddress And \VirtualAddress+ \VirtualSize > ExportVirtualAddress ;Export function
  356.           FileSeek(PeFile_ID,( ExportVirtualAddress-\VirtualAddress)+\PointerToRawData)
  357.           ReadData(PeFile_ID,@tIMAGE_EXPORT_DIRECTORY,SizeOf(IMAGE_EXPORT_DIRECTORY))
  358.           CopyMemory(@tIMAGE_EXPORT_DIRECTORY,@*iPB_PEExplorer\IMAGE_EXPORT_DIRECTORYInfo,SizeOf(IMAGE_EXPORT_DIRECTORY))
  359.           FileSeek(PeFile_ID, (tIMAGE_EXPORT_DIRECTORY\Name-(\VirtualAddress - \PointerToRawData)))
  360.           *iPB_PEExplorer\IMAGE_EXPORT_DIRECTORYInfo\__File_OriginalDllName = ReadString(PeFile_ID)            
  361.           For o = 0 To tIMAGE_EXPORT_DIRECTORY\NumberOfNames-1
  362.             AddElement( *iPB_PEExplorer\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe())
  363.             FileSeek(PeFile_ID, (tIMAGE_EXPORT_DIRECTORY\AddressOfNames-(\VirtualAddress - \PointerToRawData))+(o*SizeOf(long)))
  364.             FileSeek(PeFile_ID, ReadLong(PeFile_ID)-(\VirtualAddress - \PointerToRawData))
  365.             *iPB_PEExplorer\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()\FunctionName  = ReadString(PeFile_ID)
  366.             FileSeek(PeFile_ID, (tIMAGE_EXPORT_DIRECTORY\AddressOfNameOrdinals-(\VirtualAddress - \PointerToRawData))+(o*SizeOf(word)))
  367.             *iPB_PEExplorer\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()\Ordinale = ReadWord(PeFile_ID)
  368.             FileSeek(PeFile_ID, (tIMAGE_EXPORT_DIRECTORY\AddressOfFunctions-(\VirtualAddress - \PointerToRawData))+
  369.                                 (*iPB_PEExplorer\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()\Ordinale*SizeOf(long)))
  370.             *iPB_PEExplorer\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()\FunctionAddress=  ReadLong(PeFile_ID)
  371.           Next
  372.         EndIf
  373.        
  374.         If \VirtualAddress <= ResourceVirtualAddress And \VirtualAddress+ \VirtualSize > ResourceVirtualAddress
  375.           FileSeek(PeFile_ID,ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)
  376.           ReadData(PeFile_ID,@tIMAGE_RESOURCE_DIRECTORY,SizeOf(IMAGE_RESOURCE_DIRECTORY))
  377.           CopyMemory(@tIMAGE_RESOURCE_DIRECTORY,@*iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo,SizeOf(IMAGE_RESOURCE_DIRECTORY))      
  378.           *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\__File_ResourceDirectoryCount = (tIMAGE_RESOURCE_DIRECTORY\NumberOfIdEntries+tIMAGE_RESOURCE_DIRECTORY\NumberOfNamedEntries)-1        
  379.           For o=0 To (tIMAGE_RESOURCE_DIRECTORY\NumberOfIdEntries+tIMAGE_RESOURCE_DIRECTORY\NumberOfNamedEntries)-1        
  380.             FileSeek(PeFile_ID,(ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)+SizeOf(IMAGE_RESOURCE_DIRECTORY)+(SizeOf(IMAGE_RESOURCE_DIRECTORY_ENTRY)*o))
  381.             ReadData(PeFile_ID,@tIMAGE_RESOURCE_DIRECTORY_ENTRY,SizeOf(IMAGE_RESOURCE_DIRECTORY_ENTRY))
  382.             AddElement(*iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList())
  383.             If Resource_IsNameString(tIMAGE_RESOURCE_DIRECTORY_ENTRY\NameOffset)
  384.               FileSeek(PeFile_ID,((ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)+Resource_NameAddress(tIMAGE_RESOURCE_DIRECTORY_ENTRY\NameOffset)))
  385.               ReadData(PeFile_ID,@tIMAGE_RESOURCE_DIRECTORY_STRING,SizeOf(IMAGE_RESOURCE_DIRECTORY_STRING))
  386.               *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName = ReadString(PeFile_ID,#PB_Unicode,tIMAGE_RESOURCE_DIRECTORY_STRING\Length)
  387.             Else
  388.               *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryID =   (tIMAGE_RESOURCE_DIRECTORY_ENTRY\NameOffset)
  389.             EndIf
  390.             If Resource_IsDirectory(tIMAGE_RESOURCE_DIRECTORY_ENTRY\OffsetToData)
  391.               FileSeek(PeFile_ID,((ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)+Resource_DirectoryAddress(tIMAGE_RESOURCE_DIRECTORY_ENTRY\OffsetToData)))
  392.               ReadData(PeFile_ID,@tChildIMAGE_RESOURCE_DIRECTORY,SizeOf(IMAGE_RESOURCE_DIRECTORY))
  393.               CopyMemory(@tChildIMAGE_RESOURCE_DIRECTORY,@*iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList(),SizeOf(IMAGE_RESOURCE_DIRECTORY))      
  394.               *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceSubDirectoryCount = tChildIMAGE_RESOURCE_DIRECTORY\NumberOfIdEntries+tChildIMAGE_RESOURCE_DIRECTORY\NumberOfNamedEntries
  395.               For z=0 To (tChildIMAGE_RESOURCE_DIRECTORY\NumberOfIdEntries+tChildIMAGE_RESOURCE_DIRECTORY\NumberOfNamedEntries)-1        
  396.                 AddElement(*iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList())
  397.                 FileSeek(PeFile_ID,(ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)+SizeOf(IMAGE_RESOURCE_DIRECTORY)+Resource_DirectoryAddress(tIMAGE_RESOURCE_DIRECTORY_ENTRY\OffsetToData) +(SizeOf(IMAGE_RESOURCE_DIRECTORY_ENTRY)*z))
  398.                 ReadData(PeFile_ID,@tChildIMAGE_RESOURCE_DIRECTORY_ENTRY,SizeOf(IMAGE_RESOURCE_DIRECTORY_ENTRY))
  399.                 If Resource_IsNameString(tChildIMAGE_RESOURCE_DIRECTORY_ENTRY\NameOffset)
  400.                   FileSeek(PeFile_ID,((ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)+Resource_NameAddress(tChildIMAGE_RESOURCE_DIRECTORY_ENTRY\NameOffset)))
  401.                   ReadData(PeFile_ID,@tIMAGE_RESOURCE_DIRECTORY_STRING,SizeOf(IMAGE_RESOURCE_DIRECTORY_STRING))
  402.                   *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName = ReadString(PeFile_ID,#PB_Unicode,tIMAGE_RESOURCE_DIRECTORY_STRING\Length)
  403.                 Else
  404.                   *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryID = ( tChildIMAGE_RESOURCE_DIRECTORY_ENTRY\NameOffset)
  405.                 EndIf          
  406.                 If Resource_IsDirectory(tChildIMAGE_RESOURCE_DIRECTORY_ENTRY\OffsetToData)
  407.                   FileSeek(PeFile_ID,((ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)+Resource_DirectoryAddress(tChildIMAGE_RESOURCE_DIRECTORY_ENTRY\OffsetToData)))
  408.                   ReadData(PeFile_ID,@tChildI1MAGE_RESOURCE_DIRECTORY,SizeOf(IMAGE_RESOURCE_DIRECTORY))
  409.                   CopyMemory(@tChildI1MAGE_RESOURCE_DIRECTORY,@*iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList(),SizeOf(IMAGE_RESOURCE_DIRECTORY))      
  410.                   FileSeek(PeFile_ID,(ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)+SizeOf(IMAGE_RESOURCE_DIRECTORY)+Resource_DirectoryAddress(tChildIMAGE_RESOURCE_DIRECTORY_ENTRY\OffsetToData))
  411.                   ReadData(PeFile_ID,@tChild1IMAGE_RESOURCE_DIRECTORY_ENTRY,SizeOf(IMAGE_RESOURCE_DIRECTORY_ENTRY))
  412.                  
  413.                   FileSeek(PeFile_ID,((ResourceVirtualAddress-\VirtualAddress+\PointerToRawData)+Resource_DirectoryAddress(tChild1IMAGE_RESOURCE_DIRECTORY_ENTRY\OffsetToData)))
  414.                   ReadData(PeFile_ID,@tIMAGE_RESOURCE_DATA_ENTRY,SizeOf(IMAGE_RESOURCE_DATA_ENTRY))
  415.                  
  416.                   *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset = (Resource_DirectoryAddress(tIMAGE_RESOURCE_DATA_ENTRY\OffsetToData)-\VirtualAddress)+\PointerToRawData ;imagebas + OffsetToData
  417.                   *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\Size = tIMAGE_RESOURCE_DATA_ENTRY\Size
  418.                   *iPB_PEExplorer\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\CodePage = tIMAGE_RESOURCE_DATA_ENTRY\CodePage
  419.                  
  420.                 EndIf
  421.               Next
  422.             EndIf
  423.           Next
  424.         EndIf
  425.        
  426.         If \VirtualAddress <= RelocVirtualAddress And \VirtualAddress+ \VirtualSize > RelocVirtualAddress ;Relec section
  427.           FileSeek(PeFile_ID,( RelocVirtualAddress-\VirtualAddress)+\PointerToRawData)
  428.           ReadData(PeFile_ID,@tIMAGE_BASE_RELOCATION,SizeOf(IMAGE_BASE_RELOCATION))
  429.          
  430.           While tIMAGE_BASE_RELOCATION\VirtualAddress
  431.             AddElement(*iPB_PEExplorer\IMAGE_BASE_RELOCATIONList())
  432.             CopyMemory(@tIMAGE_BASE_RELOCATION,@*iPB_PEExplorer\IMAGE_BASE_RELOCATIONList(),SizeOf(IMAGE_BASE_RELOCATION))
  433.             FileSeek(PeFile_ID,(( RelocVirtualAddress-\VirtualAddress)+\PointerToRawData)+incrd+SizeOf(IMAGE_BASE_RELOCATION))
  434.             offsetReloc=ReadUnicodeCharacter(PeFile_ID)
  435.            
  436.             For itr=1 To (tIMAGE_BASE_RELOCATION\SizeOfBlock-SizeOf(IMAGE_BASE_RELOCATION))/SizeOf(Word)
  437.               AddElement(*iPB_PEExplorer\IMAGE_BASE_RELOCATIONList()\RelocationTypeList())
  438.               *iPB_PEExplorer\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u = offsetReloc
  439.              
  440.               FileSeek(PeFile_ID,(( RelocVirtualAddress-\VirtualAddress)+\PointerToRawData)+incrd+SizeOf(IMAGE_BASE_RELOCATION)+ (itr * SizeOf(Unicode)))
  441.               offsetReloc=ReadUnicodeCharacter(PeFile_ID)
  442.             Next
  443.            
  444.             incrd+ tIMAGE_BASE_RELOCATION\SizeOfBlock
  445.             FileSeek(PeFile_ID,(( RelocVirtualAddress-\VirtualAddress)+\PointerToRawData)+incrd)
  446.             ReadData(PeFile_ID,@tIMAGE_BASE_RELOCATION,SizeOf(IMAGE_BASE_RELOCATION))
  447.           Wend
  448.          
  449.         EndIf
  450.        
  451.       EndIf
  452.     EndWith
  453.   Next
  454.  
  455.   ProcedureReturn 1
  456. EndProcedure
  457.  
  458. DisableExplicit
  459.  
  460.  
  461.  
  462.  
  463. Structure VS_VERSION_INFO
  464.   wLength.u;
  465.   wValueLength.u;
  466.   wType.u       ;
  467.   szKey.u[15]   ;
  468.   Padding1.u[2] ;
  469.   Value.VS_FIXEDFILEINFO;
  470.                         ;   Padding2.u            ;
  471.                         ;   Children.u            ;
  472. EndStructure
  473.  
  474. Macro HiWord(a)
  475.   (a>>16 & $ffff)
  476. EndMacro
  477.  
  478. Macro LowWord(a)
  479.   (a & $ffff)
  480. EndMacro
  481.  
  482. EnableExplicit
  483.  
  484. CoInitializeEx_(0, #COINIT_MULTITHREADED)
  485. Global pIShellLink.IShellLinkW
  486. Global pIPersistFile.IPersistFile
  487. If CoCreateInstance_(?CLSID_ShellLink, 0,
  488.                      #CLSCTX_INPROC_SERVER, ?IID_IShellLink, @pIShellLink) = 0
  489.   pIShellLink\QueryInterface(?IID_IPersistFile , @pIPersistFile)
  490. EndIf
  491.  
  492. #File_Info="File Info"
  493. #DOS_HEADER="DOS_HEADER"
  494. #IMAGE_NT_HEADERS="IMAGE_NT_HEADERS"
  495. #FILE_HEADER="FILE_HEADER"
  496. #OPTIONAL_HEADER="OPTIONAL_HEADER"
  497. #SECTION_HEADER="SECTION_HEADER"
  498. #DESCRIPTOR_IMPORT="DESCRIPTOR_IMPORT"
  499. #DESCRIPTOR_EXPORT="DESCRIPTOR_EXPORT"
  500. #DESCRIPTOR_RESOURCE="DESCRIPTOR_RESOURCE"
  501. #DESCRIPTOR_RELOCATION="DESCRIPTOR_RELOCATION"
  502. #ENDOFDATA="+Overlay"
  503.  
  504. Enumeration Window_PeExplorer
  505.   #Window_PeExplorer
  506. EndEnumeration
  507.  
  508. Enumeration Window_Gadget_PeExplorer
  509.   #Gadget_ListIcon_PeExplorer
  510.   #Gadget_Tree_PeExplorer
  511.   #Gadget_Splitter_PeExplorer
  512. EndEnumeration
  513.  
  514. Enumeration FormMenu_PeExplorer
  515.   #Menu_Window_PeExplorer
  516. EndEnumeration
  517.  
  518. Enumeration FormMenuItem_PeExplorer
  519.   #MenuItem_SelectFile
  520.   #MenuItem_Exit
  521. EndEnumeration
  522.  
  523. Enumeration FormStatusBar_PeExplorer
  524.   #StatusBar_PeExplorer
  525. EndEnumeration
  526.  
  527. Enumeration FormStatusBarItem_PeExplorer
  528.   #StatusBarItem_PeInfo
  529.   #StatusBarItem_PeProgress
  530. EndEnumeration
  531.  
  532. Global CurrentPB_PEExplorerFile.PB_PEExplorer
  533. Global CurrentFileLoc.s{#MAX_PATH}
  534.  
  535. Procedure.s GetFilePathFromLnk(Lnk.s)
  536.   Protected pWIN32_FIND_DATA.WIN32_FIND_DATA
  537.   Protected Path.s{#MAX_PATH}
  538.   If pIPersistFile And pIShellLink
  539.     If pIPersistFile\Load(Lnk,0) = 0
  540.       If pIShellLink\GetPath(@Path,#MAX_PATH*2,@pWIN32_FIND_DATA,1) = 0
  541.         ProcedureReturn Path
  542.       EndIf
  543.     EndIf
  544.   EndIf
  545. EndProcedure
  546. Procedure.s GetLongPathName(lpszShortPath.s)
  547.   Protected lpszLongPath.s{#MAX_PATH}
  548.   GetLongPathName_(@lpszShortPath,@lpszLongPath,#MAX_PATH)
  549.   ProcedureReturn lpszLongPath
  550. EndProcedure
  551. Procedure.s GetShortPathName(lpszLongPath.s)
  552.   Protected lpszShortPath.s{#MAX_PATH}
  553.   GetShortPathName_(@lpszLongPath,@lpszShortPath,#MAX_PATH)
  554.   ProcedureReturn lpszShortPath
  555. EndProcedure
  556. Procedure.s FindFile(Pthdll$,aDll$,SubDirCount.l=0,Pcall.b=1)
  557.   Protected iReturn$,DirectoryEntryName$
  558.   Protected ed=ExamineDirectory(#PB_Any, Pthdll$, "*.*")  
  559.   If ed
  560.     While NextDirectoryEntry(ed)
  561.       DirectoryEntryName$=DirectoryEntryName(ed)
  562.       If DirectoryEntryType(ed) = #PB_DirectoryEntry_File
  563.         If  FindString(DirectoryEntryName$, aDll$,1,#PB_String_NoCase)
  564.           iReturn$ = Pthdll$ + "\" + aDll$
  565.         EndIf
  566.       ElseIf SubDirCount < 5
  567.         If DirectoryEntryName$="." Or DirectoryEntryName$=".." :Continue:EndIf
  568.         SubDirCount+1
  569.         iReturn$=FindFile(Pthdll$+"\" + DirectoryEntryName$,aDll$,SubDirCount,0)
  570.       Else
  571.         If Pcall=1
  572.           SubDirCount=0
  573.         EndIf
  574.       EndIf
  575.       If iReturn$:Break:EndIf
  576.     Wend
  577.     FinishDirectory(ed)
  578.   EndIf
  579.   ProcedureReturn iReturn$
  580. EndProcedure
  581.  
  582. Macro AddList(strlist,s)
  583.   AddElement(strlist):strlist = s
  584. EndMacro
  585. Procedure ResizeGadgetsWindow_PeExplorer()
  586.   Protected FormWindowWidth, FormWindowHeight
  587.   FormWindowWidth = WindowWidth(#Window_PeExplorer)
  588.   FormWindowHeight = WindowHeight(#Window_PeExplorer)
  589.   ResizeGadget(#Gadget_Splitter_PeExplorer, 5, 5, FormWindowWidth-10, FormWindowHeight - MenuHeight() - StatusBarHeight(#StatusBar_PeExplorer) - 10)
  590. EndProcedure
  591. Procedure CloseWindow_PeExplorer()
  592.   PostEvent(#PB_Event_CloseWindow, #Window_PeExplorer, 0)
  593. EndProcedure
  594.  
  595. Procedure LoadPlugins_PeExplorer()
  596.   Protected ed=ExamineDirectory(#PB_Any, "Plugins", "*.dll")  
  597.   If ed
  598.     While NextDirectoryEntry(ed)
  599.       If DirectoryEntryType(ed) = #PB_DirectoryEntry_File
  600.         Protected ol=OpenLibrary(#PB_Any,"Plugins\"+DirectoryEntryName(ed))
  601.         If ol
  602.           If Not CallFunction(ol,"PeExplorer_Plugin_Ini",WindowID(#Window_PeExplorer),@CurrentFileLoc)
  603.             CloseLibrary(ol)
  604.           EndIf
  605.         EndIf
  606.       EndIf
  607.     Wend
  608.     FinishDirectory(ed)
  609.   EndIf
  610. EndProcedure
  611.  
  612. Procedure.s Pex_Hex_Value(Value.q,Type.l, Addx.s="0x")
  613.   Protected slong.l
  614.   Select Type
  615.     Case #PB_Byte
  616.       slong=2
  617.     Case #PB_Word
  618.       slong=4
  619.     Case #PB_Long
  620.       slong=8
  621.     Case #PB_Quad
  622.       slong=16
  623.   EndSelect
  624.   ProcedureReturn Addx+RSet (Hex(Value,Type),slong,"0")
  625. EndProcedure
  626. Procedure.s Pex_Resource_Type (nRes.u)
  627.   Select nRes
  628.     Case #RT_ACCELERATOR:ProcedureReturn "#RT_ACCELERATOR"
  629.     Case #RT_ANICURSOR:ProcedureReturn "#RT_ANICURSOR"
  630.     Case #RT_ANIICON:ProcedureReturn "#RT_ANIICON"
  631.     Case #RT_BITMAP:ProcedureReturn "#RT_BITMAP"
  632.     Case #RT_CURSOR:ProcedureReturn "#RT_CURSOR"
  633.     Case #RT_DIALOG:ProcedureReturn "#RT_DIALOG"
  634.     Case #RT_DLGINCLUDE:ProcedureReturn "#RT_DLGINCLUDE"
  635.     Case #RT_FONT:ProcedureReturn "#RT_FONT"
  636.     Case #RT_FONTDIR:ProcedureReturn "#RT_FONTDIR"
  637.     Case #RT_GROUP_CURSOR:ProcedureReturn "#RT_GROUP_CURSOR"
  638.     Case #RT_GROUP_ICON:ProcedureReturn "#RT_GROUP_ICON"
  639.     Case #RT_HTML:ProcedureReturn "#RT_HTML"
  640.     Case #RT_ICON:ProcedureReturn "#RT_ICON"
  641.     Case #RT_MANIFEST:ProcedureReturn "#RT_MANIFEST"
  642.     Case #RT_MENU:ProcedureReturn "#RT_MENU"
  643.     Case #RT_MESSAGETABLE:ProcedureReturn "#RT_MESSAGETABLE"
  644.     Case #RT_PLUGPLAY:ProcedureReturn "#RT_PLUGPLAY"
  645.     Case #RT_RCDATA:ProcedureReturn "#RT_RCDATA"
  646.     Case #RT_STRING:ProcedureReturn "#RT_STRING"
  647.     Case #RT_VERSION:ProcedureReturn "#RT_VERSION"
  648.     Case #RT_VXD:ProcedureReturn "#RT_VXD"
  649.   EndSelect
  650.   ProcedureReturn Str(nRes)
  651. EndProcedure
  652. Procedure.s Pex_Machine_Type(Machine.u)
  653.   Select Machine
  654.     Case #IMAGE_FILE_MACHINE_I386:ProcedureReturn "X86"
  655.     Case #IMAGE_FILE_MACHINE_IA64:ProcedureReturn "Intel Itanium"
  656.     Case #IMAGE_FILE_MACHINE_AMD64:ProcedureReturn "X64"
  657.   EndSelect
  658. EndProcedure
  659. Procedure.s Pex_Exe_Type(Characteristics.u)
  660.   If Characteristics &#IMAGE_FILE_DLL = #IMAGE_FILE_DLL
  661.     ProcedureReturn "Image is a DLL"
  662.   ElseIf Characteristics &#IMAGE_FILE_EXECUTABLE_IMAGE = #IMAGE_FILE_EXECUTABLE_IMAGE
  663.     ProcedureReturn "Image is a EXE"
  664.   EndIf
  665. EndProcedure
  666. Procedure.s Pex_Image_Type(Magic.u)
  667.   Select Magic
  668.     Case #IMAGE_NT_OPTIONAL_HDR32_MAGIC
  669.       ProcedureReturn "32bit"
  670.     Case #IMAGE_NT_OPTIONAL_HDR64_MAGIC
  671.       ProcedureReturn "64bit"
  672.     Case #IMAGE_ROM_OPTIONAL_HDR_MAGIC
  673.       ProcedureReturn "Rom image"
  674.   EndSelect
  675. EndProcedure
  676.  
  677. Structure ImageFile_Type
  678.   Characteristics.u
  679.   Desc.s
  680. EndStructure
  681.  
  682. Procedure.s Pex_ImageFile_Type(Characteristics.w)
  683.   Dim aImageFile_Type.ImageFile_Type(14)
  684.  
  685.   aImageFile_Type(0)\Characteristics = #IMAGE_FILE_RELOCS_STRIPPED
  686.   aImageFile_Type(1)\Characteristics = #IMAGE_FILE_EXECUTABLE_IMAGE
  687.   aImageFile_Type(2)\Characteristics = #IMAGE_FILE_LINE_NUMS_STRIPPED
  688.   aImageFile_Type(3)\Characteristics = #IMAGE_FILE_LOCAL_SYMS_STRIPPED
  689.   aImageFile_Type(4)\Characteristics = #IMAGE_FILE_AGGRESIVE_WS_TRIM
  690.   aImageFile_Type(5)\Characteristics = #IMAGE_FILE_LARGE_ADDRESS_AWARE
  691.   aImageFile_Type(6)\Characteristics = #IMAGE_FILE_BYTES_REVERSED_LO
  692.   aImageFile_Type(7)\Characteristics = #IMAGE_FILE_32BIT_MACHINE
  693.   aImageFile_Type(8)\Characteristics = #IMAGE_FILE_DEBUG_STRIPPED
  694.   aImageFile_Type(9)\Characteristics = #IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
  695.   aImageFile_Type(10)\Characteristics = #IMAGE_FILE_NET_RUN_FROM_SWAP
  696.   aImageFile_Type(11)\Characteristics = #IMAGE_FILE_SYSTEM
  697.   aImageFile_Type(12)\Characteristics = #IMAGE_FILE_DLL
  698.   aImageFile_Type(13)\Characteristics = #IMAGE_FILE_UP_SYSTEM_ONLY
  699.   aImageFile_Type(14)\Characteristics = #IMAGE_FILE_BYTES_REVERSED_HI
  700.   aImageFile_Type(0)\Desc = "IMAGE_FILE_RELOCS_STRIPPED"
  701.   aImageFile_Type(1)\Desc = "IMAGE_FILE_EXECUTABLE_IMAGE"
  702.   aImageFile_Type(2)\Desc = "IMAGE_FILE_LINE_NUMS_STRIPPED"
  703.   aImageFile_Type(3)\Desc = "IMAGE_FILE_LOCAL_SYMS_STRIPPED"
  704.   aImageFile_Type(4)\Desc = "IMAGE_FILE_AGGRESIVE_WS_TRIM"
  705.   aImageFile_Type(5)\Desc = "IMAGE_FILE_LARGE_ADDRESS_AWARE"
  706.   aImageFile_Type(6)\Desc = "IMAGE_FILE_BYTES_REVERSED_LO"
  707.   aImageFile_Type(7)\Desc = "IMAGE_FILE_32BIT_MACHINE"
  708.   aImageFile_Type(8)\Desc = "IMAGE_FILE_DEBUG_STRIPPED"
  709.   aImageFile_Type(9)\Desc = "IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP"
  710.   aImageFile_Type(10)\Desc = "IMAGE_FILE_NET_RUN_FROM_SWAP"
  711.   aImageFile_Type(11)\Desc = "IMAGE_FILE_SYSTEM"
  712.   aImageFile_Type(12)\Desc = "IMAGE_FILE_DLL"
  713.   aImageFile_Type(13)\Desc = "IMAGE_FILE_UP_SYSTEM_ONLY"
  714.   aImageFile_Type(14)\Desc = "IMAGE_FILE_BYTES_REVERSED_HI"
  715.  
  716.   Protected sReturn.s,o
  717.   For o = 0 To 14
  718.     If aImageFile_Type(o)\Characteristics & Characteristics = aImageFile_Type(o)\Characteristics
  719.       sReturn + aImageFile_Type(o)\Desc + " | "
  720.     EndIf
  721.   Next
  722.   ProcedureReturn Mid(sReturn,1,Len(sReturn) - 3)
  723. EndProcedure
  724.  
  725. Procedure.s Pex_Subsystem_Type(Subsystem.u)
  726.   Select Subsystem
  727.     Case #IMAGE_SUBSYSTEM_NATIVE
  728.       ProcedureReturn "Subsystem : native"
  729.     Case #IMAGE_SUBSYSTEM_WINDOWS_GUI
  730.       ProcedureReturn "Subsystem : Windows GUI"
  731.     Case #IMAGE_SUBSYSTEM_WINDOWS_CUI
  732.       ProcedureReturn "Subsystem : Windows CUI"
  733.     Case #IMAGE_SUBSYSTEM_OS2_CUI
  734.       ProcedureReturn "Subsystem :  OS2."
  735.     Case #IMAGE_SUBSYSTEM_POSIX_CUI
  736.       ProcedureReturn "Subsystem :  Posix."
  737.     Case #IMAGE_SUBSYSTEM_WINDOWS_CE_GUI
  738.       ProcedureReturn "Subsystem :  Windows CE."
  739.     Case #IMAGE_SUBSYSTEM_EFI_APPLICATION
  740.       ProcedureReturn "Subsystem :  Extensible Firmware Interface."
  741.     Case #IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER
  742.       ProcedureReturn "Subsystem :  Extensible Firmware Interface."
  743.     Case #IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER
  744.       ProcedureReturn "Subsystem :  Extensible Firmware Interface."
  745.     Case #IMAGE_SUBSYSTEM_EFI_ROM
  746.       ProcedureReturn "Subsystem :  Extensible Firmware Interface."
  747.     Case #IMAGE_SUBSYSTEM_XBOX
  748.       ProcedureReturn "Subsystem : Xbox."
  749.     Case #IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION
  750.       ProcedureReturn "Subsystem :  Boot Application."
  751.     Default
  752.       ProcedureReturn "unknown Subsystem"
  753.   EndSelect
  754. EndProcedure
  755. Procedure.s Pex_Dll_Characteristics(DllCharacteristics.u)
  756.   Select DllCharacteristics
  757.     Case  #IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
  758.       ProcedureReturn "The DLL can be relocated at load time."
  759.     Case #IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
  760.       ProcedureReturn "Code integrity checks are forced."
  761.     Case #IMAGE_DLLCHARACTERISTICS_NX_COMPAT
  762.       ProcedureReturn "The image is compatible With Data execution prevention (DEP)."
  763.     Case #IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
  764.       ProcedureReturn "The image is isolation aware, but should Not be isolated."
  765.     Case   #IMAGE_DLLCHARACTERISTICS_NO_SEH
  766.       ProcedureReturn "The image does Not use structured exception handling (SEH)."
  767.     Case #IMAGE_DLLCHARACTERISTICS_NO_BIND
  768.       ProcedureReturn "Do Not bind the image"
  769.     Case #IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
  770.       ProcedureReturn "A WDM driver"
  771.     Case #IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
  772.       ProcedureReturn "The image is terminal server aware."
  773.   EndSelect
  774. EndProcedure
  775. Procedure.s Pex_HexRawData_Read(ResOffset.l,ResSize.l,ReadSize.l,ReturnHex.b=1)
  776.   Protected Rd = ReadFile(#PB_Any, CurrentFileLoc)
  777.   If Rd
  778.     If ReadSize >= ResSize:ReadSize=ResSize:EndIf
  779.     If ReadSize > 0 And ResOffset > 0 And ResOffset + ReadSize <= Lof(Rd)
  780.       FileSeek(Rd,ResOffset)
  781.       Protected u.l,pb.a,Returna$ ,Returns$
  782.       For u=1 To ReadSize
  783.         pb = ReadAsciiCharacter(Rd)
  784.         Returna$ + Pex_Hex_Value(pb,#PB_Byte,"") + "  "
  785.         If pb=0:pb=Asc("."):EndIf
  786.         Returns$ + Chr(pb)
  787.       Next
  788.     EndIf
  789.     CloseFile(Rd)
  790.   EndIf
  791.   If ReturnHex
  792.     ProcedureReturn Returna$
  793.   EndIf
  794.   ProcedureReturn Returns$
  795. EndProcedure
  796. Procedure.i Pex_MemRawData_Read(ResOffset.l,ReadSize.l)
  797.   Protected Rd = ReadFile(#PB_Any, CurrentFileLoc)
  798.   If Rd
  799.     If ReadSize > 0 And ResOffset > 0 And ResOffset + ReadSize <= Lof(Rd)
  800.       Protected *Almem=AllocateMemory(ReadSize)
  801.       If *Almem
  802.         FileSeek(Rd,ResOffset)
  803.         ReadData(Rd,*Almem,ReadSize)
  804.       EndIf
  805.     EndIf
  806.     CloseFile(Rd)
  807.   EndIf
  808.   ProcedureReturn *Almem
  809. EndProcedure
  810. Procedure.b Pex_UpxPacker_Detect()
  811.   Protected IspUpx.b
  812.   With CurrentPB_PEExplorerFile
  813.     ForEach \IMAGE_SECTION_HEADERList()
  814.       If Left(\IMAGE_SECTION_HEADERList()\__File_Selction_Name,3) = "UPX"
  815.         IspUpx+1
  816.       EndIf
  817.     Next
  818.   EndWith
  819.   ProcedureReturn IspUpx
  820. EndProcedure
  821. Procedure.b Pex_UpxPacker_UnPacked()
  822.   Protected ru,Sortie$,Rderr$
  823.   If MessageRequester("","UPX packer Detected.. "+#CRLF$ + "Do you want decompress file !", #PB_MessageRequester_YesNo)<>#PB_MessageRequester_Yes
  824.     ProcedureReturn
  825.   EndIf
  826.   If FileSize("upx.exe") < 1
  827.     ProcedureReturn MessageRequester("","Upx.exe not found!")
  828.   EndIf
  829.   ru=RunProgram("upx","-d " + GetShortPathName(CurrentFileLoc), GetCurrentDirectory(), #PB_Program_Open | #PB_Program_Read |#PB_Program_Error|#PB_Program_Hide)
  830.   If ru
  831.     While ProgramRunning(ru)
  832.       If AvailableProgramOutput(ru)
  833.         ReadProgramString(ru)
  834.         Rderr$=ReadProgramError(ru)
  835.         If Rderr$
  836.           Sortie$ + Rderr$ + Chr(13)
  837.         EndIf
  838.       EndIf
  839.     Wend
  840.     If ProgramExitCode(ru)=1
  841.       MessageRequester("UPX Error!",Sortie$)
  842.       ProcedureReturn 0
  843.     EndIf
  844.     ProcedureReturn 1
  845.   EndIf
  846. EndProcedure
  847. Procedure.s Pex_DLL_FindPath(aDll$)
  848.   Protected WindowsDirectory.s{#MAX_PATH},SystemWindowsDirectory.s{#MAX_PATH}
  849.   GetWindowsDirectory_(@WindowsDirectory,#MAX_PATH)
  850.   GetSystemDirectory_(@SystemWindowsDirectory,#MAX_PATH)
  851.   If FileSize(WindowsDirectory+"\"+aDll$) > 0
  852.     ProcedureReturn WindowsDirectory+"\"+aDll$
  853.   EndIf
  854.   If FileSize(SystemWindowsDirectory+"\"+aDll$) > 0
  855.     ProcedureReturn SystemWindowsDirectory+"\"+aDll$
  856.   EndIf
  857.   Protected DllPath.s{#MAX_PATH}
  858.   Protected lb,CloseLib.b
  859.   lb=  GetModuleHandle_(aDll$)
  860.   If Not lb
  861.     lb=LoadLibraryEx_(aDll$,0,$00000001)
  862.     CloseLib = 1
  863.   EndIf
  864.   If lb
  865.     GetModuleFileName_(lb,@DllPath,#MAX_PATH)
  866.     If CloseLib
  867.       FreeLibrary_(lb)
  868.     EndIf
  869.     If DllPath
  870.       ProcedureReturn DllPath
  871.     EndIf
  872.   EndIf
  873.   Protected Pthdll$=RTrim(GetPathPart(CurrentFileLoc),"\")
  874.   If Pthdll$
  875.     Protected iFind$=FindFile(Pthdll$,aDll$)
  876.     If iFind$
  877.       ProcedureReturn iFind$
  878.     EndIf
  879.   EndIf
  880.   ProcedureReturn "?\"+aDll$
  881. EndProcedure
  882. Procedure.s Pex_RawData_Hash(ReadOffset.l=0,ReadSize.l=0)
  883.   Protected Rdf=ReadFile(#PB_Any,CurrentFileLoc)
  884.   If Rdf
  885.     If ReadSize=0:ReadSize=Lof(Rdf):EndIf
  886.     If Lof(Rdf) < ReadOffset+ReadSize:ReadSize=Lof(Rdf)-ReadOffset:EndIf
  887.     If ReadSize < 1 :ProcedureReturn:EndIf
  888.     FileSeek(Rdf,ReadOffset)
  889.     Protected *Dataf=AllocateMemory(1024*64)
  890.     If *Dataf
  891.       UseMD5Fingerprint()
  892.       Protected fmd5 = StartFingerprint(#PB_Any, #PB_Cipher_MD5)
  893.       If fmd5
  894.         Protected Rd.l,iReturn$,irds.l=1024*64,ird.l
  895.         Repeat
  896.           If ird+irds > ReadSize:irds=ReadSize-ird:EndIf
  897.           Rd=ReadData(Rdf,*Dataf,irds)
  898.           AddFingerprintBuffer(fmd5, *Dataf, Rd)  
  899.           ird+Rd
  900.           If ird=ReadSize:Break:EndIf
  901.         ForEver
  902.         iReturn$=  FinishFingerprint(fmd5)
  903.       EndIf
  904.       FreeMemory(*Dataf)
  905.     EndIf
  906.     CloseFile(Rdf)
  907.   EndIf
  908.   ProcedureReturn iReturn$
  909. EndProcedure
  910. Procedure.s Pex_Section_Characteristics(Characteristics.l)
  911.   Protected sReturn.s
  912.   If Characteristics& #IMAGE_SCN_CNT_CODE :sReturn + "CODE + ":EndIf
  913.   If Characteristics& #IMAGE_SCN_CNT_INITIALIZED_DATA :sReturn + "INITIALIZED_DATA + ":EndIf
  914.   If Characteristics& #IMAGE_SCN_CNT_UNINITIALIZED_DATA :sReturn + "UNINITIALIZED_DATA + ":EndIf
  915.   If Characteristics& #IMAGE_SCN_MEM_SHARED :sReturn + "MEM_SHARED + ":EndIf
  916.   If Characteristics& #IMAGE_SCN_MEM_EXECUTE :sReturn + "MEM_EXECUTE + ":EndIf
  917.   If Characteristics& #IMAGE_SCN_MEM_READ :sReturn + "MEM_READ + ":EndIf
  918.   If Characteristics& #IMAGE_SCN_MEM_WRITE :sReturn + "MEM_WRITE + ":EndIf
  919.   ProcedureReturn Mid(sReturn,1,Len(sReturn)-2)
  920. EndProcedure
  921. Macro Pex_Is64Bit()
  922.   Bool(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32\OptionalHeader\Magic  = #IMAGE_NT_OPTIONAL_HDR64_MAGIC)
  923. EndMacro
  924. Procedure.s Pex_Date_Format(lDat.l)
  925.   If lDat > 0
  926.     ProcedureReturn FormatDate("%yyyy/ %mm/ %dd %hh:%ii:%ss",lDat)+" UTC"
  927.   EndIf
  928. EndProcedure
  929.  
  930. Procedure Pex_Resource_Read(ResourceDir.l,ResourceNameStr.s,ResourceNameInt.l,ResourceOffset.l,ResourceSize.l)
  931.   Protected sReturn.s
  932.   Select ResourceDir
  933.     Case #RT_MANIFEST
  934.       Protected *Versionmem =Pex_MemRawData_Read(ResourceOffset,ResourceSize)
  935.       If *Versionmem
  936.         sReturn= PeekS(*Versionmem,ResourceSize,#PB_Ascii)
  937.         FreeMemory(*Versionmem)
  938.       EndIf
  939.     Case #RT_VERSION
  940.       *Versionmem =Pex_MemRawData_Read(ResourceOffset,ResourceSize)
  941.       If *Versionmem
  942.         Protected *vr.VS_VERSION_INFO=*Versionmem
  943.         Protected FileVersion.s= Str(HiWord(*vr\Value\dwFileVersionMS)) +
  944.                                  "." +Str(LowWord(*vr\Value\dwFileVersionMS)) +
  945.                                  "." +Str(HiWord(*vr\Value\dwFileVersionLS)) +
  946.                                  "." + Str(LowWord(*vr\Value\dwFileVersionLS))
  947.         Protected ProductVersion.s= Str(HiWord(*vr\Value\dwProductVersionMS)) +
  948.                                     "." +Str(LowWord(*vr\Value\dwProductVersionMS)) +
  949.                                     "." +Str(HiWord(*vr\Value\dwProductVersionLS)) +
  950.                                     "." + Str(LowWord(*vr\Value\dwProductVersionLS))
  951.        
  952.         sReturn + "<" + PeekS(@*vr\szKey)+ ">" + #CRLF$ + #CRLF$
  953.         sReturn + "      File Version: " + FileVersion + #CRLF$
  954.         sReturn + "      Product Version: " + ProductVersion + #CRLF$
  955.         sReturn + "      Characteristics: " + Pex_Hex_Value(*vr\Value\dwFileType,#PB_Long) + ", " + Pex_Hex_Value(*vr\Value\dwFileOS,#PB_Long) + #CRLF$
  956.        
  957.         Protected ChildrenLen.l
  958.         Protected *cvr.VS_VERSION_INFO
  959.         While ChildrenLen < *vr\wLength-SizeOf(VS_VERSION_INFO)
  960.           *cvr = *vr+SizeOf(VS_VERSION_INFO)+ChildrenLen
  961.           ChildrenLen+*cvr\wLength
  962.           If Mod(ChildrenLen,4)
  963.             ChildrenLen+4-Mod(ChildrenLen,4)
  964.           EndIf
  965.           Select PeekS(@*cvr\szKey)
  966.             Case "StringFileInfo"
  967.               Protected *ccvr.VS_VERSION_INFO=*cvr+36
  968.              
  969.               sReturn + #CRLF$ + "      <StringFileInfo>"            
  970.               Protected szKey.s= PeekS(@*ccvr\szKey)
  971.               sReturn + #CRLF$ +  "          <" + szKey + ">" + #CRLF$
  972.               sReturn + "              Language identifier: " + "0x" + Mid(szKey,1,4)+ #CRLF$
  973.               sReturn + "              Code page: " + "0x" + Mid(szKey,3,4)+ #CRLF$ + #CRLF$
  974.              
  975.               Protected iOffset.l,iPadding.l,iLength.l
  976.               While iOffset < *ccvr\wLength - 24
  977.                 Protected *cccvr.VS_VERSION_INFO=*ccvr+24+iOffset
  978.                 iLength=*cccvr\wLength
  979.                 iPadding=Mod(iLength,4)
  980.                 If iPadding:iLength+4-iPadding:EndIf
  981.                 szKey= PeekS(@*cccvr\szKey)
  982.                 iPadding = 4 - Mod(2 * Len(szKey) + 6, 4)
  983.                
  984.                 sReturn + "                  " + szKey + ": " + PeekS(@*cccvr\szKey+(Len(szKey)*2)+iPadding) +#CRLF$
  985.                
  986.                 iOffset+iLength
  987.               Wend
  988.              
  989.               sReturn + #CRLF$ + "          </" + PeekS(@*ccvr\szKey) + ">"
  990.               sReturn + #CRLF$ + "      </StringFileInfo>" + #CRLF$
  991.              
  992.             Case "VarFileInfo"
  993.               *ccvr=*cvr+32
  994.              
  995.               sReturn + #CRLF$ + "      <VarFileInfo>"
  996.               sReturn + #CRLF$ +  "          <" + PeekS(@*ccvr\szKey) + ">" + #CRLF$
  997.              
  998.               Protected i.l,Val.w
  999.               For i=0 To (*ccvr\wValueLength/2)-1
  1000.                 Val= PeekW(*ccvr+32+(2*i))
  1001.                
  1002.                 If Mod(i,2)
  1003.                   sReturn + "              Language identifier: " + Pex_Hex_Value(Val,#PB_Word)  + #CRLF$
  1004.                 Else
  1005.                   sReturn + "              Code page: " + Pex_Hex_Value(Val,#PB_Word)  + #CRLF$                      
  1006.                 EndIf
  1007.                
  1008.               Next
  1009.              
  1010.               sReturn + #CRLF$ + "          </" + PeekS(@*ccvr\szKey) + ">"
  1011.               sReturn + #CRLF$ + "      </VarFileInfo>" + #CRLF$
  1012.              
  1013.           EndSelect
  1014.         Wend
  1015.        
  1016.         sReturn + #CRLF$ + "</" + PeekS(@*vr\szKey)+ ">" + #CRLF$      
  1017.         FreeMemory(*Versionmem)
  1018.       EndIf
  1019.   EndSelect
  1020.   If sReturn
  1021.     MessageRequester("", sReturn)
  1022.   EndIf
  1023. EndProcedure
  1024.  
  1025. Procedure.s Pex_Reloc_Type(Type.u)
  1026.   Protected sReturn.s
  1027.   Select Type
  1028.     Case #IMAGE_REL_BASED_ABSOLUTE
  1029.       sReturn = "IMAGE_REL_BASED_ABSOLUTE(0)"
  1030.     Case #IMAGE_REL_BASED_HIGH
  1031.       sReturn = "IMAGE_REL_BASED_HIGH(1)"
  1032.     Case #IMAGE_REL_BASED_LOW
  1033.       sReturn = "IMAGE_REL_BASED_LOW(2)"
  1034.     Case #IMAGE_REL_BASED_HIGHLOW
  1035.       sReturn = "IMAGE_REL_BASED_HIGHLOW(3)"
  1036.     Case #IMAGE_REL_BASED_HIGHADJ
  1037.       sReturn = "IMAGE_REL_BASED_HIGHADJ(4)"
  1038.     Case #IMAGE_REL_BASED_MIPS_JMPADDR
  1039.       sReturn = "IMAGE_REL_BASED_MIPS_JMPADDR(5)"
  1040.     Case #IMAGE_REL_BASED_DIR64
  1041.       sReturn = "IMAGE_REL_BASED_DIR64(10)"
  1042.   EndSelect
  1043.   ProcedureReturn sReturn
  1044. EndProcedure
  1045.  
  1046. Procedure SetInfoHeader_PeExplorer(ItHeader.s,SelectType.s="",ResFileType.s="")
  1047.   NewList gilist.s()
  1048.   Select ItHeader
  1049.     Case #DESCRIPTOR_RELOCATION
  1050.       If ResFileType <> ""
  1051.        
  1052.         With CurrentPB_PEExplorerFile
  1053.           ForEach \IMAGE_BASE_RELOCATIONList()
  1054.             If Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\VirtualAddress,#PB_Long) = SelectType
  1055.               Protected SRVA = \IMAGE_BASE_RELOCATIONList()\VirtualAddress
  1056.               ForEach \IMAGE_BASE_RELOCATIONList()\RelocationTypeList()
  1057.                 If   Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u,#PB_Word) = ResFileType
  1058.                   Protected Offset = (\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u & $0fff)
  1059.                   Protected Type = ((\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u >> 12) & $000F)
  1060.                   AddList(gilist(),"RVA" +Chr(10) + Pex_Hex_Value(Offset +
  1061.                                                                   \IMAGE_BASE_RELOCATIONList()\VirtualAddress ,#PB_Long)+Chr(10) +
  1062.                                    "Offset : " + Str(Offset))
  1063.                   AddList(gilist(),"Type" +Chr(10) +Pex_Reloc_Type(Type))
  1064.                   Break
  1065.                 EndIf
  1066.               Next
  1067.             EndIf
  1068.           Next
  1069.         EndWith
  1070.         If Offset
  1071.           ForEach CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  1072.             With CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  1073.               If \VirtualAddress <= SRVA And \VirtualAddress+ \VirtualSize > SRVA
  1074.                 Protected *plong.long = Pex_MemRawData_Read(\PointerToRawData + Offset,SizeOf(long))
  1075.                 If *plong
  1076.                   Protected ImageBase.q = CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32\OptionalHeader\ImageBase
  1077.                   If Pex_Is64Bit()
  1078.                     ImageBase = CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\ImageBase
  1079.                   EndIf
  1080.                   Protected RRVA = *plong\l - ImageBase
  1081.                   AddList(gilist(),"Data" +Chr(10) +Pex_Hex_Value(*plong\l,#PB_Long) +
  1082.                                    Chr(10) + *plong\l)
  1083.                   FreeMemory(*plong)
  1084.                 EndIf
  1085.                 Break
  1086.               EndIf
  1087.             EndWith
  1088.           Next
  1089.           If RRVA > 0
  1090.             ForEach CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  1091.               With CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  1092.                 If \VirtualAddress <= RRVA And \VirtualAddress+ \VirtualSize > RRVA
  1093.                   AddList(gilist(),"Remote Section " + Chr(10) + \__File_Selction_Name +
  1094.                                    Chr(10) + "Remote Offset : " + Str(RRVA))
  1095.                   Break
  1096.                 EndIf
  1097.               EndWith
  1098.             Next
  1099.           EndIf
  1100.         EndIf
  1101.       ElseIf SelectType <> ""
  1102.        
  1103.         With CurrentPB_PEExplorerFile
  1104.           ForEach \IMAGE_BASE_RELOCATIONList()
  1105.             If Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\VirtualAddress,#PB_Long) = SelectType
  1106.               AddList(gilist(),"SizeOfBlock" +Chr(10) + Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\SizeOfBlock,#PB_Long) + Chr(10) +
  1107.                                Str(\IMAGE_BASE_RELOCATIONList()\SizeOfBlock) + " Byte")
  1108.               AddList(gilist(),"Items" +Chr(10) +Str(ListSize(\IMAGE_BASE_RELOCATIONList()\RelocationTypeList())))
  1109.               SRVA = \IMAGE_BASE_RELOCATIONList()\VirtualAddress
  1110.               Break
  1111.             EndIf
  1112.           Next
  1113.         EndWith
  1114.        
  1115.         ForEach CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  1116.           With CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  1117.             If \VirtualAddress <= SRVA And \VirtualAddress+ \VirtualSize > SRVA
  1118.               AddList(gilist(),"Section" +Chr(10) +\__File_Selction_Name)
  1119.               Break
  1120.             EndIf
  1121.           EndWith
  1122.         Next
  1123.        
  1124.       Else
  1125.         Protected RelocCount.l
  1126.         With CurrentPB_PEExplorerFile
  1127.           ForEach \IMAGE_BASE_RELOCATIONList()
  1128.             RelocCount+ListSize(\IMAGE_BASE_RELOCATIONList()\RelocationTypeList())
  1129.           Next
  1130.         EndWith
  1131.         AddList(gilist(),"Relocation Count" + Chr(10) + Str(RelocCount))          
  1132.       EndIf  
  1133.      
  1134.     Case#File_Info
  1135.       AddList(gilist(),"Name" +Chr(10) + GetFilePart(CurrentFileLoc))
  1136.       AddList(gilist(),"Size" +Chr(10) +Str(FileSize(CurrentFileLoc) ) + " Byte")
  1137.       AddList(gilist(),"Offset Entry Code" +Chr(10) +
  1138.                        Pex_Hex_Value(CurrentPB_PEExplorerFile\__File_OffsetEntryCode,#PB_Long ) +
  1139.                        Chr(10) + Str(CurrentPB_PEExplorerFile\__File_OffsetEntryCode))
  1140.       AddList(gilist(),"MD5 Hash" +Chr(10) + Pex_RawData_Hash())
  1141.      
  1142.       With CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32
  1143.         StatusBarText(#StatusBar_PeExplorer, #StatusBarItem_PeInfo, (CurrentFileLoc) +
  1144.                                                                     "         " +
  1145.                                                                     " Made for :" +
  1146.                                                                     Pex_Machine_Type(\FileHeader\Machine) +
  1147.                                                                     "         " +
  1148.                                                                     "  Machine :" +
  1149.                                                                     Pex_Image_Type(\OptionalHeader\Magic))
  1150.       EndWith
  1151.      
  1152.     Case #DOS_HEADER
  1153.       With CurrentPB_PEExplorerFile\IMAGE_DOS_HEADER
  1154.         AddList(gilist(),"e_magic" + Chr(10) + Pex_Hex_Value(\e_magic,#PB_Word) +
  1155.                          Chr(10) + Chr(PeekA(@\e_magic)) + Chr(PeekA(@\e_magic+1)))
  1156.         AddList(gilist(),"e_cblp" + Chr(10) + Pex_Hex_Value(\e_cblp,#PB_Word))
  1157.         AddList(gilist(),"e_cp" + Chr(10) + Pex_Hex_Value(\e_cp,#PB_Word))
  1158.         AddList(gilist(),"e_crlc" + Chr(10) + Pex_Hex_Value(\e_crlc,#PB_Word))
  1159.         AddList(gilist(),"e_cparhdr" + Chr(10) + Pex_Hex_Value(\e_cparhdr,#PB_Word))
  1160.         AddList(gilist(),"e_minalloc" + Chr(10) + Pex_Hex_Value(\e_minalloc,#PB_Word))
  1161.         AddList(gilist(),"e_maxalloc" + Chr(10) + Pex_Hex_Value(\e_maxalloc,#PB_Word))
  1162.         AddList(gilist(),"e_ss" + Chr(10) + Pex_Hex_Value(\e_ss,#PB_Word))
  1163.         AddList(gilist(),"e_sp" + Chr(10) + Pex_Hex_Value(\e_sp,#PB_Word))
  1164.         AddList(gilist(),"e_csum" + Chr(10) + Pex_Hex_Value(\e_csum,#PB_Word))
  1165.         AddList(gilist(),"e_ip" + Chr(10) + Pex_Hex_Value(\e_ip,#PB_Word))
  1166.         AddList(gilist(),"e_cs" + Chr(10) + Pex_Hex_Value(\e_cs,#PB_Word))
  1167.         AddList(gilist(),"e_lfarlc" + Chr(10) + Pex_Hex_Value(\e_lfarlc,#PB_Word))
  1168.         AddList(gilist(),"e_ovno" + Chr(10) + Pex_Hex_Value(\e_ovno,#PB_Word))
  1169.         AddList(gilist(),"e_res[0]" + Chr(10) + Pex_Hex_Value(\e_res[0],#PB_Word))
  1170.         AddList(gilist(),"e_res[1]" + Chr(10) + Pex_Hex_Value(\e_res[1],#PB_Word))
  1171.         AddList(gilist(),"e_res[2]" + Chr(10) + Pex_Hex_Value(\e_res[2],#PB_Word))
  1172.         AddList(gilist(),"e_res[3]" + Chr(10) + Pex_Hex_Value(\e_res[3],#PB_Word))
  1173.         AddList(gilist(),"e_oemid" + Chr(10) + Pex_Hex_Value(\e_oemid,#PB_Word))
  1174.         AddList(gilist(),"e_oeminfo" + Chr(10) + Pex_Hex_Value(\e_oeminfo,#PB_Word))
  1175.         AddList(gilist(),"e_res2[0]" + Chr(10) + Pex_Hex_Value(\e_res2[0],#PB_Word))
  1176.         AddList(gilist(),"e_res2[1]" + Chr(10) + Pex_Hex_Value(\e_res2[1],#PB_Word))
  1177.         AddList(gilist(),"e_res2[2]" + Chr(10) + Pex_Hex_Value(\e_res2[2],#PB_Word))
  1178.         AddList(gilist(),"e_res2[3]" + Chr(10) + Pex_Hex_Value(\e_res2[3],#PB_Word))
  1179.         AddList(gilist(),"e_res2[4]" + Chr(10) + Pex_Hex_Value(\e_res2[4],#PB_Word))
  1180.         AddList(gilist(),"e_res2[5]" + Chr(10) + Pex_Hex_Value(\e_res2[5],#PB_Word))
  1181.         AddList(gilist(),"e_res2[6]" + Chr(10) + Pex_Hex_Value(\e_res2[6],#PB_Word))
  1182.         AddList(gilist(),"e_res2[7]" + Chr(10) + Pex_Hex_Value(\e_res2[7],#PB_Word))
  1183.         AddList(gilist(),"e_res2[8]" + Chr(10) + Pex_Hex_Value(\e_res2[8],#PB_Word))
  1184.         AddList(gilist(),"e_res2[9]" + Chr(10) + Pex_Hex_Value(\e_res2[9],#PB_Word))
  1185.         AddList(gilist(),"e_lfanew" + Chr(10) + Pex_Hex_Value(\e_lfanew,#PB_Long))
  1186.       EndWith
  1187.     Case #IMAGE_NT_HEADERS
  1188.       With CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32
  1189.         AddList(gilist(),"Signature" + Chr(10) + Pex_Hex_Value(\Signature,#PB_Long)+
  1190.                          Chr(10) + Chr(PeekA(@\Signature)) + Chr(PeekA(@\Signature+1)))
  1191.       EndWith
  1192.     Case #FILE_HEADER
  1193.       With CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32\FileHeader
  1194.         AddList(gilist(),"Machine" + Chr(10) + Pex_Hex_Value(\Machine,#PB_Word)+ Chr(10) + Pex_Machine_Type(\Machine))
  1195.         AddList(gilist(),"NumberOfSections" + Chr(10) + Pex_Hex_Value(\NumberOfSections,#PB_Word) +
  1196.                          Chr(10) + Str(\NumberOfSections))
  1197.         AddList(gilist(),"TimeDateStamp" + Chr(10) + Pex_Hex_Value(\TimeDateStamp,#PB_Long)+
  1198.                          Chr(10) + "Date created : " + Pex_Date_Format(\TimeDateStamp))
  1199.         AddList(gilist(),"PointerToSymbolTable" + Chr(10) + Pex_Hex_Value(\PointerToSymbolTable,#PB_Long))
  1200.         AddList(gilist(),"NumberOfSymbols" + Chr(10) + Pex_Hex_Value(\NumberOfSymbols,#PB_Long))
  1201.         AddList(gilist(),"SizeOfOptionalHeader" + Chr(10) + Pex_Hex_Value(\SizeOfOptionalHeader,#PB_Word) +
  1202.                          Chr(10) + Str(\SizeOfOptionalHeader) + " Byte")
  1203.         AddList(gilist(),"Characteristics" + Chr(10) + Pex_Hex_Value(\Characteristics,#PB_Word) +
  1204.                          Chr(10) + Pex_ImageFile_Type(\Characteristics))
  1205.       EndWith
  1206.     Case #OPTIONAL_HEADER
  1207.       With CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32\OptionalHeader
  1208.         AddList(gilist(),"Magic" + Chr(10) + Pex_Hex_Value(\Magic,#PB_Word)+ Chr(10) + Pex_Image_Type(\Magic))
  1209.         AddList(gilist(),"MajorLinkerVersion" + Chr(10) + Pex_Hex_Value(\MajorLinkerVersion,#PB_Byte)+
  1210.                          Chr(10) + "Linker Version : " + Str(\MajorLinkerVersion) +"."+ Str( \MinorLinkerVersion))
  1211.         AddList(gilist(),"MinorLinkerVersion" + Chr(10) + Pex_Hex_Value(\MinorLinkerVersion,#PB_Byte))
  1212.         AddList(gilist(),"SizeOfCode" + Chr(10) + Pex_Hex_Value(\SizeOfCode,#PB_Long)  +
  1213.                          Chr(10) + Str(\SizeOfCode) + " Byte")
  1214.         AddList(gilist(),"SizeOfInitializedData" + Chr(10) + Pex_Hex_Value(\SizeOfInitializedData,#PB_Long) +
  1215.                          Chr(10) + Str(\SizeOfInitializedData) + " Byte")
  1216.         AddList(gilist(),"SizeOfUninitializedData" + Chr(10) + Pex_Hex_Value(\SizeOfUninitializedData,#PB_Long) +
  1217.                          Chr(10) + Str(\SizeOfUninitializedData) + " Byte")
  1218.         AddList(gilist(),"AddressOfEntryPoint" + Chr(10) + Pex_Hex_Value(\AddressOfEntryPoint,#PB_Long) +
  1219.                          Chr(10) + Str(\AddressOfEntryPoint))
  1220.         AddList(gilist(),"BaseOfCode" + Chr(10) + Pex_Hex_Value(\BaseOfCode,#PB_Long) + Chr(10) + Str(\baseofcode))
  1221.         If Pex_Is64Bit()
  1222.           AddList(gilist(),"ImageBase" + Chr(10) +
  1223.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\ImageBase,#PB_Quad)  +
  1224.                            Chr(10) + Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\ImageBase))
  1225.         Else
  1226.           AddList(gilist(),"BaseOfData" + Chr(10) + Pex_Hex_Value(\BaseOfData,#PB_Long) +
  1227.                            Chr(10) + Str(\BaseOfData))  
  1228.           AddList(gilist(),"ImageBase" + Chr(10) + Pex_Hex_Value(\ImageBase,#PB_Long) +
  1229.                            Chr(10) + Str(\ImageBase))
  1230.         EndIf
  1231.         AddList(gilist(),"SectionAlignment" + Chr(10) + Pex_Hex_Value(\SectionAlignment,#PB_Long)+
  1232.                          Chr(10) + Str(\SectionAlignment))
  1233.         AddList(gilist(),"FileAlignment" + Chr(10) + Pex_Hex_Value(\FileAlignment,#PB_Long) +
  1234.                          Chr(10) + Str(\FileAlignment))
  1235.         AddList(gilist(),"MajorOperatingSystemVersion" + Chr(10) + Pex_Hex_Value(\MajorOperatingSystemVersion,#PB_Word)+
  1236.                          Chr(10) + "Required operating system Version :" + Str(\MajorOperatingSystemVersion) +
  1237.                          "."+ Str( \MinorOperatingSystemVersion))
  1238.         AddList(gilist(),"MinorOperatingSystemVersion" + Chr(10) + Pex_Hex_Value(\MinorOperatingSystemVersion,#PB_Word))
  1239.         AddList(gilist(),"MajorImageVersion" + Chr(10) + Pex_Hex_Value(\MajorImageVersion,#PB_Word)+
  1240.                          Chr(10) + "Image Version : " + Str(\MajorImageVersion) +"."+ Str( \MinorImageVersion))
  1241.         AddList(gilist(),"MinorImageVersion" + Chr(10) + Pex_Hex_Value(\MinorImageVersion,#PB_Word))
  1242.         AddList(gilist(),"MajorSubsystemVersion" + Chr(10) + Pex_Hex_Value(\MajorSubsystemVersion,#PB_Word)+
  1243.                          Chr(10) + "Subsystem Version : " + Str(\MajorSubsystemVersion) +"."+
  1244.                          Str( \MinorSubsystemVersion))
  1245.         AddList(gilist(),"MinorSubsystemVersion" + Chr(10) + Pex_Hex_Value(\MinorSubsystemVersion,#PB_Word))
  1246.         AddList(gilist(),"Win32VersionValue" + Chr(10) + Pex_Hex_Value(\Win32VersionValue,#PB_Long))
  1247.         AddList(gilist(),"SizeOfImage" + Chr(10) + Pex_Hex_Value(\SizeOfImage,#PB_Long) +
  1248.                          Chr(10) + Str(\SizeOfImage) + " Byte")
  1249.         AddList(gilist(),"SizeOfHeaders" + Chr(10) + Pex_Hex_Value(\SizeOfHeaders,#PB_Long)  +
  1250.                          Chr(10) + Str(\SizeOfHeaders) + " Byte")
  1251.         AddList(gilist(),"CheckSum" + Chr(10) + Pex_Hex_Value(\CheckSum,#PB_Long))
  1252.         AddList(gilist(),"Subsystem" + Chr(10) + Pex_Hex_Value(\Subsystem,#PB_Word)+
  1253.                          Chr(10) + Pex_Subsystem_Type(\Subsystem))
  1254.         AddList(gilist(),"DllCharacteristics" + Chr(10) + Pex_Hex_Value(\DllCharacteristics,#PB_Word)+
  1255.                          Chr(10) + Pex_Dll_Characteristics(\DllCharacteristics))
  1256.         If Pex_Is64Bit()
  1257.           AddList(gilist(),"SizeOfStackReserve" + Chr(10) +
  1258.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfStackReserve,#PB_Quad)+ Chr(10) +
  1259.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfStackReserve))
  1260.           AddList(gilist(),"SizeOfStackCommit" + Chr(10) + Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfStackCommit,#PB_Quad)+ Chr(10) +
  1261.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfStackCommit))
  1262.           AddList(gilist(),"SizeOfHeapReserve" + Chr(10) +
  1263.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfHeapReserve,#PB_Quad) + Chr(10) +
  1264.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfHeapReserve))
  1265.           AddList(gilist(),"SizeOfHeapCommit" + Chr(10) +
  1266.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfHeapCommit,#PB_Quad) + Chr(10) +
  1267.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfHeapCommit))
  1268.           AddList(gilist(),"LoaderFlags" + Chr(10) +
  1269.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\LoaderFlags,#PB_Long) + Chr(10) +
  1270.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\LoaderFlags))
  1271.           AddList(gilist(),"NumberOfRvaAndSizes" + Chr(10) +
  1272.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\NumberOfRvaAndSizes,#PB_Long) + Chr(10) +
  1273.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\NumberOfRvaAndSizes))
  1274.         Else
  1275.           AddList(gilist(),"SizeOfStackReserve" + Chr(10) + Pex_Hex_Value(\SizeOfStackReserve,#PB_Long) +
  1276.                            Chr(10) + Str(\SizeOfStackReserve))
  1277.           AddList(gilist(),"SizeOfStackCommit" + Chr(10) + Pex_Hex_Value(\SizeOfStackCommit,#PB_Long) +
  1278.                            Chr(10) + Str(\SizeOfStackCommit))
  1279.           AddList(gilist(),"SizeOfHeapReserve" + Chr(10) + Pex_Hex_Value(\SizeOfHeapReserve,#PB_Long) +
  1280.                            Chr(10) + Str(\SizeOfHeapReserve))
  1281.           AddList(gilist(),"SizeOfHeapCommit" + Chr(10) + Pex_Hex_Value(\SizeOfHeapCommit,#PB_Long) +
  1282.                            Chr(10) + Str(\SizeOfHeapCommit))
  1283.           AddList(gilist(),"LoaderFlags" + Chr(10) + Pex_Hex_Value(\LoaderFlags,#PB_Long) + Chr(10) +
  1284.                            Str(\LoaderFlags))
  1285.           AddList(gilist(),"NumberOfRvaAndSizes" + Chr(10) + Pex_Hex_Value(\NumberOfRvaAndSizes,#PB_Long) +
  1286.                            Chr(10) + Str(\NumberOfRvaAndSizes))
  1287.         EndIf
  1288.       EndWith
  1289.     Case #SECTION_HEADER
  1290.       If SelectType = #SECTION_HEADER
  1291.         With CurrentPB_PEExplorerFile
  1292.           AddList(gilist(),"Section count" + Chr(10) + Str(ListSize(\IMAGE_SECTION_HEADERList())))
  1293.         EndWith
  1294.       Else
  1295.         ForEach CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  1296.           With CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  1297.             If \__File_Selction_Name = SelectType
  1298.               AddList(gilist(),"SecName[8]" + Chr(10) + Pex_Hex_Value(PeekQ(@\SecName),#PB_Quad)+ Chr(10) + SelectType)
  1299.               AddList(gilist(),"PhysicalAddr" + Chr(10) + Pex_Hex_Value(\PhysicalAddr,#PB_Long))
  1300.               AddList(gilist(),"VirtualSize" + Chr(10) + Pex_Hex_Value(\VirtualSize,#PB_Long) +
  1301.                                Chr(10) + Str(\VirtualSize) + " Byte")
  1302.               AddList(gilist(),"VirtualAddress" + Chr(10) + Pex_Hex_Value(\VirtualAddress,#PB_Long)  +
  1303.                                Chr(10) + Str(\VirtualAddress))
  1304.               AddList(gilist(),"SizeOfRawData" + Chr(10) + Pex_Hex_Value(\SizeOfRawData,#PB_Long)  + Chr(10) +
  1305.                                Str(\SizeOfRawData) + " Byte")
  1306.               AddList(gilist(),"PointerToRawData" + Chr(10) + Pex_Hex_Value(\PointerToRawData,#PB_Long) +
  1307.                                Chr(10) + Str(\PointerToRawData))
  1308.               AddList(gilist(),"PointerToRelocations" + Chr(10) + Pex_Hex_Value(\PointerToRelocations,#PB_Long))
  1309.               AddList(gilist(),"PointerToLinenumbers" + Chr(10) + Pex_Hex_Value(\PointerToLinenumbers,#PB_Long))
  1310.               AddList(gilist(),"NumberOfRelocations" + Chr(10) + Pex_Hex_Value(\NumberOfRelocations,#PB_Word))
  1311.               AddList(gilist(),"NumberOfLinenumbers" + Chr(10) + Pex_Hex_Value(\NumberOfLinenumbers,#PB_Word))
  1312.               AddList(gilist(),"Characteristics" + Chr(10) + Pex_Hex_Value(\Characteristics,#PB_Long)+ Chr(10) +
  1313.                                Pex_Section_Characteristics(\Characteristics))
  1314.               AddList(gilist(),"")            
  1315.               AddList(gilist(),"Section MD5 Hash" + Chr(10) +Pex_RawData_Hash(\PointerToRawData,\SizeOfRawData))
  1316.               Break
  1317.             EndIf
  1318.           EndWith
  1319.         Next
  1320.       EndIf
  1321.     Case #DESCRIPTOR_IMPORT
  1322.       If ResFileType <> ""
  1323.         Protected fUnctioname$
  1324.         With CurrentPB_PEExplorerFile\IMAGE_IMPORT_DESCRIPTORInfo
  1325.           ForEach \IMAGE_IMPORT_DESCRIPTORList()
  1326.             If \IMAGE_IMPORT_DESCRIPTORList()\LibraryName = SelectType
  1327.               ForEach \IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()
  1328.                 If \IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\Ordinal
  1329.                   If Pex_Is64Bit()
  1330.                     fUnctioname$=Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\Ordinal&$ffffff,#PB_Quad)
  1331.                   Else
  1332.                     fUnctioname$=Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\Ordinal&$ffffff,#PB_Long)            
  1333.                   EndIf
  1334.                 Else
  1335.                   fUnctioname$= \IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\FunctionName              
  1336.                 EndIf
  1337.                 If fUnctioname$ = ResFileType
  1338.                   If \IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\Ordinal
  1339.                     AddList(gilist(),"Ordinal" + Chr(10) + fUnctioname$)
  1340.                   Else
  1341.                     AddList(gilist(),"Name" + Chr(10) + fUnctioname$)
  1342.                   EndIf
  1343.                  
  1344.                   If Pex_Is64Bit()
  1345.                     AddList(gilist(),"IMAGE_THUNK_DATA" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\IMAGE_THUNK_DATA,#PB_Quad))
  1346.                   Else
  1347.                     AddList(gilist(),"IMAGE_THUNK_DATA" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\IMAGE_THUNK_DATA,#PB_Long))
  1348.                   EndIf
  1349.                  
  1350.                   Break
  1351.                 EndIf
  1352.               Next
  1353.               Break
  1354.             EndIf
  1355.           Next
  1356.         EndWith
  1357.       ElseIf SelectType <> ""
  1358.         With CurrentPB_PEExplorerFile\IMAGE_IMPORT_DESCRIPTORInfo
  1359.           ForEach \IMAGE_IMPORT_DESCRIPTORList()
  1360.             If \IMAGE_IMPORT_DESCRIPTORList()\LibraryName = SelectType
  1361.               AddList(gilist(),"OriginalFirstThunk" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\OriginalFirstThunk,#PB_Long))
  1362.               AddList(gilist(),"TimeDateStamp" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\TimeDateStamp,#PB_Long)+ Chr(10) +
  1363.                                "Date : " + Pex_Date_Format(\IMAGE_IMPORT_DESCRIPTORList()\TimeDateStamp))
  1364.               AddList(gilist(),"ForwarderChain" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ForwarderChain,#PB_Long))
  1365.               AddList(gilist(),"Name" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\Name,#PB_Long))
  1366.               AddList(gilist(),"FirstThunk" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\FirstThunk,#PB_Long))
  1367.               Break
  1368.             EndIf
  1369.           Next
  1370.         EndWith      
  1371.       Else
  1372.         Protected FuncCount.l
  1373.         With CurrentPB_PEExplorerFile\IMAGE_IMPORT_DESCRIPTORInfo
  1374.           ForEach \IMAGE_IMPORT_DESCRIPTORList()
  1375.             FuncCount+ListSize(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList())
  1376.           Next
  1377.         EndWith
  1378.         AddList(gilist(),"Function Count" + Chr(10) + Str(FuncCount))          
  1379.       EndIf
  1380.     Case #DESCRIPTOR_EXPORT
  1381.       If SelectType <> ""
  1382.         With CurrentPB_PEExplorerFile\IMAGE_EXPORT_DIRECTORYInfo
  1383.           ForEach \ExportFunctionNameListe()
  1384.             If \ExportFunctionNameListe()\FunctionName = SelectType
  1385.               AddList(gilist(),"Address" + Chr(10) + Pex_Hex_Value(\ExportFunctionNameListe()\FunctionAddress,#PB_Long))
  1386.               AddList(gilist(),"Ordinale" + Chr(10) + Pex_Hex_Value(\ExportFunctionNameListe()\Ordinale,#PB_Word))
  1387.               Break
  1388.             EndIf
  1389.           Next
  1390.         EndWith
  1391.       Else
  1392.         With CurrentPB_PEExplorerFile\IMAGE_EXPORT_DIRECTORYInfo
  1393.           AddList(gilist(),"Characteristics" + Chr(10) + Pex_Hex_Value(\Characteristics,#PB_Long))
  1394.           AddList(gilist(),"TimeDateStamp" + Chr(10) + Pex_Hex_Value(\TimeDateStamp,#PB_Long)+
  1395.                            Chr(10) + "Date : " + Pex_Date_Format(\TimeDateStamp))
  1396.           AddList(gilist(),"MajorVersion" + Chr(10) + Pex_Hex_Value(\MajorVersion,#PB_Word)+
  1397.                            Chr(10) + Str(\MajorVersion) + "." + Str(\MinorVersion))
  1398.           AddList(gilist(),"MinorVersion" + Chr(10) + Pex_Hex_Value(\MinorVersion,#PB_Word))
  1399.           AddList(gilist(),"Name" + Chr(10) + Pex_Hex_Value(\Name,#PB_Long)+ Chr(10) + \__File_OriginalDllName)
  1400.           AddList(gilist(),"Base" + Chr(10) + Pex_Hex_Value(\Base,#PB_Long))
  1401.           AddList(gilist(),"NumberOfFunctions" + Chr(10) + Pex_Hex_Value(\NumberOfFunctions,#PB_Long) +
  1402.                            Chr(10) + Str(\NumberOfFunctions))
  1403.           AddList(gilist(),"NumberOfNames" + Chr(10) + Pex_Hex_Value(\NumberOfNames,#PB_Long) +
  1404.                            Chr(10) + Str(\NumberOfNames))
  1405.           AddList(gilist(),"AddressOfFunctions" + Chr(10) + Pex_Hex_Value(\AddressOfFunctions,#PB_Long))
  1406.           AddList(gilist(),"AddressOfNames" + Chr(10) + Pex_Hex_Value(\AddressOfNames,#PB_Long))
  1407.           AddList(gilist(),"AddressOfNameOrdinals" + Chr(10) + Pex_Hex_Value(\AddressOfNameOrdinals,#PB_Long))
  1408.         EndWith
  1409.       EndIf
  1410.     Case #ENDOFDATA
  1411.       With CurrentPB_PEExplorerFile
  1412.         AddList(gilist(),"Size" + Chr(10) + Str(FileSize(CurrentFileLoc)-\__File_ImageSize) + " Byte")
  1413.         AddList(gilist(),"File Offset" + Chr(10) + Pex_Hex_Value(\__File_ImageSize,#PB_Long) +
  1414.                          Chr(10) + Str(\__File_ImageSize))  
  1415.         AddList(gilist(),"Frist 30 Byte Of Data" + Chr(10) +
  1416.                          Pex_HexRawData_Read(\__File_ImageSize,FileSize(CurrentFileLoc)-\__File_ImageSize,30,1) +
  1417.                          Chr(10) + ReplaceString(Pex_HexRawData_Read(\__File_ImageSize,FileSize(CurrentFileLoc)-\__File_ImageSize,30,0),Chr(10),""))
  1418.       EndWith
  1419.     Case #DESCRIPTOR_RESOURCE
  1420.       Protected Cres$,ResnType$
  1421.       If SelectType <> ""
  1422.         If  ResFileType <> ""
  1423.           With CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo
  1424.             ForEach \ResourceDirectoryList()
  1425.               If \ResourceDirectoryList()\__File_ResourceDirectoryName
  1426.                 Cres$= \ResourceDirectoryList()\__File_ResourceDirectoryName
  1427.                 ResnType$ = "String"
  1428.               Else
  1429.                 Cres$ = Pex_Resource_Type(\ResourceDirectoryList()\__File_ResourceDirectoryID)
  1430.                 ResnType$ = "Integer"
  1431.               EndIf
  1432.               If   Cres$ = SelectType
  1433.                 ForEach \ResourceDirectoryList()\ResourceSubDirectoryList()
  1434.                   If \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName
  1435.                     Cres$= \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName
  1436.                     ResnType$ = "String"
  1437.                   Else
  1438.                     Cres$ = Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryID)
  1439.                     ResnType$ = "Integer"
  1440.                   EndIf
  1441.                   If   Cres$ = ResFileType
  1442.                     AddList(gilist(),"Characteristics" + Chr(10) +
  1443.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\Characteristics,#PB_Long)+
  1444.                                      Chr(10) + "Entry Name Type : " + ResnType$);
  1445.                     AddList(gilist(),"TimeDateStamp" + Chr(10) +
  1446.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\TimeDateStamp,#PB_Long)+
  1447.                                      Chr(10) + "Date : " + Pex_Date_Format(\ResourceDirectoryList()\ResourceSubDirectoryList()\TimeDateStamp))      
  1448.                     AddList(gilist(),"MajorVersion" + Chr(10) +
  1449.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\MajorVersion,#PB_Word)+
  1450.                                      Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\MajorVersion) + "." +
  1451.                                      Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\MinorVersion))  
  1452.                     AddList(gilist(),"MinorVersion" + Chr(10) +
  1453.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\MinorVersion,#PB_Word))        
  1454.                     AddList(gilist(),"NumberOfNamedEntries" + Chr(10) +
  1455.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\NumberOfNamedEntries,#PB_Word)+
  1456.                                      Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\NumberOfNamedEntries))
  1457.                     AddList(gilist(),"NumberOfIdEntries" + Chr(10) +
  1458.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\NumberOfIdEntries,#PB_Word) +
  1459.                                      Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\NumberOfIdEntries))
  1460.                     AddList(gilist(),"")            
  1461.                     AddList(gilist(),"File Resource Offset" + Chr(10) +
  1462.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset,#PB_Long)+
  1463.                                      Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset))
  1464.                     AddList(gilist(),"OffsetToData" + Chr(10) +
  1465.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\OffsetToData,#PB_Long))
  1466.                     AddList(gilist(),"Size" + Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\Size) + " Byte")
  1467.                     AddList(gilist(),"CodePage" + Chr(10) +
  1468.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\CodePage,#PB_Long))
  1469.                     AddList(gilist(),"Frist 30 Byte Of resource" + Chr(10) +
  1470.                                      Pex_HexRawData_Read(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset,\ResourceDirectoryList()\ResourceSubDirectoryList()\Size,30) +
  1471.                                      Chr(10) + ReplaceString(Pex_HexRawData_Read(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset,\ResourceDirectoryList()\ResourceSubDirectoryList()\Size,30,0),Chr(10),""))
  1472.                    
  1473.                     Pex_Resource_Read(\ResourceDirectoryList()\__File_ResourceDirectoryID,
  1474.                                       \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName,
  1475.                                       \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryID,
  1476.                                       \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset,
  1477.                                       \ResourceDirectoryList()\ResourceSubDirectoryList()\Size)
  1478.                    
  1479.                     Break
  1480.                   EndIf
  1481.                 Next
  1482.                 Break
  1483.               EndIf
  1484.             Next
  1485.           EndWith
  1486.         Else
  1487.           ForEach CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()
  1488.             If CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName
  1489.               Cres$= CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName
  1490.               ResnType$ = "String"
  1491.             Else
  1492.               Cres$ = Pex_Resource_Type(CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryID)
  1493.               ResnType$ = "Integer"
  1494.             EndIf
  1495.             If   Cres$ = SelectType
  1496.               With CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()
  1497.                 AddList(gilist(),"Characteristics" + Chr(10) +
  1498.                                  Pex_Hex_Value(\Characteristics,#PB_Long)+ Chr(10) + "Entry Name Type : " + ResnType$);
  1499.                 AddList(gilist(),"TimeDateStamp" + Chr(10) +
  1500.                                  Pex_Hex_Value(\TimeDateStamp,#PB_Long)+ Chr(10) + "Date : " +
  1501.                                  Pex_Date_Format(\TimeDateStamp))      
  1502.                 AddList(gilist(),"MajorVersion" + Chr(10) +
  1503.                                  Pex_Hex_Value(\MajorVersion,#PB_Word)+ Chr(10) +
  1504.                                  Str(\MajorVersion) + "." + Str(\MinorVersion))  
  1505.                 AddList(gilist(),"MinorVersion" + Chr(10) + Pex_Hex_Value(\MinorVersion,#PB_Word))        
  1506.                 AddList(gilist(),"NumberOfNamedEntries" + Chr(10) + Pex_Hex_Value(\NumberOfNamedEntries,#PB_Word) +
  1507.                                  Chr(10) + Str(\NumberOfNamedEntries))
  1508.                 AddList(gilist(),"NumberOfIdEntries" + Chr(10) + Pex_Hex_Value(\NumberOfIdEntries,#PB_Word) +
  1509.                                  Chr(10) + Str(\NumberOfIdEntries))
  1510.               EndWith
  1511.               Break
  1512.             EndIf
  1513.           Next
  1514.         EndIf
  1515.       Else
  1516.         With CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo
  1517.           AddList(gilist(),"Characteristics" + Chr(10) + Pex_Hex_Value(\Characteristics,#PB_Long));
  1518.           AddList(gilist(),"TimeDateStamp" + Chr(10) + Pex_Hex_Value(\TimeDateStamp,#PB_Long)+
  1519.                            Chr(10) + "Date : " + Pex_Date_Format(\TimeDateStamp))      
  1520.           AddList(gilist(),"MajorVersion" + Chr(10) +
  1521.                            Pex_Hex_Value(\MajorVersion,#PB_Word)+ Chr(10) + Str(\MajorVersion) + "." +
  1522.                            Str(\MinorVersion))  
  1523.           AddList(gilist(),"MinorVersion" + Chr(10) + Pex_Hex_Value(\MinorVersion,#PB_Word))        
  1524.           AddList(gilist(),"NumberOfNamedEntries" + Chr(10) + Pex_Hex_Value(\NumberOfNamedEntries,#PB_Word) +
  1525.                            Chr(10) + Str(\NumberOfNamedEntries))
  1526.           AddList(gilist(),"NumberOfIdEntries" + Chr(10) + Pex_Hex_Value(\NumberOfIdEntries,#PB_Word) +
  1527.                            Chr(10) + Str(\NumberOfIdEntries))
  1528.         EndWith
  1529.       EndIf
  1530.   EndSelect
  1531.   ForEach gilist()
  1532.     AddGadgetItem(#Gadget_ListIcon_PeExplorer,-1,gilist())
  1533.   Next
  1534. EndProcedure
  1535.  
  1536. Procedure PeGetInfo_PeExplorer()
  1537.   Protected Sttree = GetGadgetState(#Gadget_Tree_PeExplorer)
  1538.   If Sttree = -1 :ProcedureReturn:EndIf
  1539.   Protected gettreeTxt$ = GetGadgetItemText(#Gadget_Tree_PeExplorer,Sttree)
  1540.   Protected t.l,Selectednode$,PerSdir$
  1541.   ClearGadgetItems(#Gadget_ListIcon_PeExplorer)
  1542.   Select gettreeTxt$
  1543.     Case #ENDOFDATA
  1544.       SetInfoHeader_PeExplorer(#ENDOFDATA)
  1545.     Case #File_Info
  1546.       SetInfoHeader_PeExplorer(#File_Info)
  1547.     Case #FILE_HEADER, #OPTIONAL_HEADER
  1548.       SetInfoHeader_PeExplorer(gettreeTxt$)
  1549.     Default
  1550.       For t=Sttree To 0 Step -1
  1551.         If GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, t, #PB_Tree_SubLevel) = 2
  1552.           If PerSdir$ =""
  1553.             PerSdir$=  GetGadgetItemText(#Gadget_Tree_PeExplorer,t)
  1554.           EndIf
  1555.         EndIf
  1556.         If GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, t, #PB_Tree_SubLevel) = 1
  1557.           Selectednode$=  GetGadgetItemText(#Gadget_Tree_PeExplorer,t)
  1558.           Break
  1559.         EndIf
  1560.       Next
  1561.       Select Selectednode$
  1562.         Case #DESCRIPTOR_RESOURCE
  1563.           If gettreeTxt$ = #DESCRIPTOR_RESOURCE
  1564.             SetInfoHeader_PeExplorer(#DESCRIPTOR_RESOURCE)
  1565.           Else  
  1566.             If GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, Sttree, #PB_Tree_SubLevel) = 2
  1567.               SetInfoHeader_PeExplorer(#DESCRIPTOR_RESOURCE,gettreeTxt$)
  1568.             Else
  1569.               SetInfoHeader_PeExplorer(#DESCRIPTOR_RESOURCE, PerSdir$,gettreeTxt$)
  1570.             EndIf
  1571.           EndIf
  1572.         Case #DESCRIPTOR_EXPORT
  1573.           If gettreeTxt$ = #DESCRIPTOR_EXPORT
  1574.             SetInfoHeader_PeExplorer(#DESCRIPTOR_EXPORT)
  1575.           Else
  1576.             SetInfoHeader_PeExplorer(#DESCRIPTOR_EXPORT,gettreeTxt$)
  1577.           EndIf
  1578.         Case #DESCRIPTOR_IMPORT
  1579.           If gettreeTxt$ = #DESCRIPTOR_IMPORT
  1580.             SetInfoHeader_PeExplorer(#DESCRIPTOR_IMPORT)
  1581.           ElseIf GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, Sttree, #PB_Tree_SubLevel) = 2
  1582.             SetInfoHeader_PeExplorer(#DESCRIPTOR_IMPORT,GetFilePart(gettreeTxt$))
  1583.           Else
  1584.             SetInfoHeader_PeExplorer(#DESCRIPTOR_IMPORT,GetFilePart(PerSdir$),gettreeTxt$)
  1585.           EndIf
  1586.          
  1587.         Case #DESCRIPTOR_RELOCATION
  1588.           If gettreeTxt$ = #DESCRIPTOR_RELOCATION
  1589.             SetInfoHeader_PeExplorer(#DESCRIPTOR_RELOCATION)
  1590.           ElseIf GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, Sttree, #PB_Tree_SubLevel) = 2
  1591.             SetInfoHeader_PeExplorer(#DESCRIPTOR_RELOCATION,GetFilePart(gettreeTxt$))
  1592.           Else
  1593.             SetInfoHeader_PeExplorer(#DESCRIPTOR_RELOCATION,GetFilePart(PerSdir$),gettreeTxt$)
  1594.           EndIf
  1595.          
  1596.         Default
  1597.           SetInfoHeader_PeExplorer(Selectednode$,gettreeTxt$)
  1598.       EndSelect
  1599.   EndSelect
  1600. EndProcedure
  1601.  
  1602. Procedure PeSetInfo_PeExplorer(FilePath.s)
  1603.   If UCase(GetExtensionPart(FilePath)) = "LNK"
  1604.     FilePath = GetFilePathFromLnk(FilePath)
  1605.     If FilePath = "":MessageRequester("","Unable to open file!"):ProcedureReturn 0:EndIf
  1606.   EndIf
  1607.   FilePath = GetLongPathName(FilePath)
  1608.   Protected tPB_PEExplorerFile.PB_PEExplorer
  1609.   Protected RdExe = ReadFile(#PB_Any, FilePath); open pe file to read
  1610.   If Not RdExe:MessageRequester("","Unable to open file!"):ProcedureReturn 0:EndIf
  1611.   If Pb_PEExplorer(RdExe ,@tPB_PEExplorerFile) = 0:CloseFile(RdExe)
  1612.     MessageRequester("","Error Get Pe Info!")
  1613.   ProcedureReturn:EndIf
  1614.   StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 40)
  1615.   CloseFile(RdExe)
  1616.   ClearStructure(@CurrentPB_PEExplorerFile,PB_PEExplorer)
  1617.   CurrentPB_PEExplorerFile=tPB_PEExplorerFile
  1618.   CurrentFileLoc = FilePath
  1619.   ClearGadgetItems(#Gadget_Tree_PeExplorer)
  1620.   ClearGadgetItems(#Gadget_ListIcon_PeExplorer)
  1621.   With CurrentPB_PEExplorerFile
  1622.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#File_Info)
  1623.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DOS_HEADER,0,1)
  1624.     SetGadgetItemState(#Gadget_Tree_PeExplorer, 0, #PB_Tree_Expanded)
  1625.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#IMAGE_NT_HEADERS,0,1)
  1626.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#FILE_HEADER,0,2)
  1627.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#OPTIONAL_HEADER,0,2)
  1628.     SetGadgetItemState(#Gadget_Tree_PeExplorer, 2, #PB_Tree_Expanded)
  1629.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#SECTION_HEADER,0,1)
  1630.     ForEach \IMAGE_SECTION_HEADERList()
  1631.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_SECTION_HEADERList()\__File_Selction_Name),0,2)
  1632.     Next
  1633.     StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 60)
  1634.     If ListSize(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()) >0
  1635.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DESCRIPTOR_IMPORT,0,1)
  1636.       ForEach \IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()
  1637.         ;         AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\LibraryName),0,2)
  1638.         AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_DLL_FindPath(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\LibraryName),0,2)
  1639.         ForEach \IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()
  1640.           If \IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\Ordinal
  1641.             If Pex_Is64Bit()
  1642.               AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\Ordinal&$ffffff,#PB_Quad),0,3)
  1643.             Else
  1644.               AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\Ordinal&$ffffff,#PB_Long),0,3)                      
  1645.             EndIf
  1646.           Else
  1647.             AddGadgetItem(#Gadget_Tree_PeExplorer,-1,\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionList()\FunctionName,0,3)                      
  1648.           EndIf
  1649.         Next
  1650.       Next
  1651.     EndIf
  1652.     StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 70)
  1653.     If ListSize(\IMAGE_BASE_RELOCATIONList()) >0
  1654.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DESCRIPTOR_RELOCATION,0,1)
  1655.       ForEach \IMAGE_BASE_RELOCATIONList()
  1656.         AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\VirtualAddress,#PB_Long),0,2)
  1657.         ForEach \IMAGE_BASE_RELOCATIONList()\RelocationTypeList()
  1658.           AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u,#PB_Word),0,3)
  1659.         Next
  1660.       Next
  1661.     EndIf
  1662.     If ListSize(\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()) >0
  1663.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DESCRIPTOR_EXPORT,0,1)
  1664.       ForEach \IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()
  1665.         AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()\FunctionName),0,2)
  1666.       Next
  1667.     EndIf
  1668.     StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 80)
  1669.     If ListSize(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()) >0
  1670.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DESCRIPTOR_RESOURCE,0,1)
  1671.       ForEach \IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()
  1672.         If \IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName
  1673.           AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName),0,2)
  1674.         Else
  1675.           AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Resource_Type(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryID),0,2)
  1676.         EndIf
  1677.         ForEach \IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()
  1678.           If \IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName
  1679.             AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName),0,3)
  1680.           Else
  1681.             AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Str(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryID),0,3)
  1682.           EndIf
  1683.         Next
  1684.       Next
  1685.     EndIf
  1686.     StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 90)
  1687.    
  1688.     If \__File_ImageSize <> FileSize(CurrentFileLoc)
  1689.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#ENDOFDATA,0,1)
  1690.     EndIf
  1691.   EndWith
  1692.   StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 100)
  1693.  
  1694.   SetInfoHeader_PeExplorer(#File_Info)
  1695.  
  1696.   SetWindowTitle(#Window_PeExplorer,"PeExplorer v 1.0 [" + GetFilePart(FilePath) + "]")
  1697.  
  1698.   If Pex_UpxPacker_Detect()
  1699.     If Pex_UpxPacker_UnPacked() = 1
  1700.       PeSetInfo_PeExplorer(FilePath)
  1701.     EndIf
  1702.   EndIf
  1703. EndProcedure
  1704.  
  1705. Procedure SelectaFile_PeExplorer()
  1706.   Protected FilePath.s=OpenFileRequester("Select a file...","","Exe or Dll|*.dll;*.exe|All|*.*",0)
  1707.   If FilePath="":ProcedureReturn:EndIf
  1708.   PeSetInfo_PeExplorer(FilePath)
  1709. EndProcedure
  1710.  
  1711. Procedure DropFileWindow_PeExplorer()
  1712.   PeSetInfo_PeExplorer(EventDropFiles())
  1713. EndProcedure
  1714.  
  1715. Procedure OpenWindow_PeExplorer()
  1716.   OpenWindow(#Window_PeExplorer, 0, 0, 820, 465, "PeExplorer v 1.0", #PB_Window_SystemMenu | #PB_Window_MinimizeGadget | #PB_Window_MaximizeGadget | #PB_Window_SizeGadget | #PB_Window_ScreenCentered)
  1717.   CreateStatusBar(  #StatusBar_PeExplorer, WindowID(#Window_PeExplorer))
  1718.   AddStatusBarField(#PB_Ignore)
  1719.   StatusBarText(  #StatusBar_PeExplorer, #StatusBarItem_PeInfo, "Hi " + UserName())
  1720.   AddStatusBarField(50)
  1721.   StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 0)
  1722.   CreateMenu(#Menu_Window_PeExplorer, WindowID(#Window_PeExplorer))
  1723.   MenuTitle("&File")
  1724.   MenuItem(#MenuItem_SelectFile, "&Open a Pe")
  1725.   MenuBar()
  1726.   MenuItem(#MenuItem_Exit, "Exit")
  1727.   MenuTitle("Plugins")
  1728.   MenuTitle("About")
  1729.   TreeGadget(#Gadget_Tree_PeExplorer, 5, 5, 205, 410)
  1730.   ListIconGadget(#Gadget_ListIcon_PeExplorer, 215, 5, 600, 410, "Member", 200)
  1731.   AddGadgetColumn(#Gadget_ListIcon_PeExplorer,1,"Value",200)
  1732.   AddGadgetColumn(#Gadget_ListIcon_PeExplorer,2,"Comment",200)
  1733.   SplitterGadget(#Gadget_Splitter_PeExplorer,5,5,600+205+5,410,#Gadget_Tree_PeExplorer,#Gadget_ListIcon_PeExplorer,#PB_Splitter_Vertical)
  1734.   EnableWindowDrop(#Window_PeExplorer, #PB_Drop_Files, #PB_Drag_Copy)
  1735.   BindEvent(#PB_Event_WindowDrop , @DropFileWindow_PeExplorer())
  1736.   BindEvent(#PB_Event_SizeWindow , @ResizeGadgetsWindow_PeExplorer())
  1737.   BindEvent(#PB_Event_CloseWindow   , @CloseWindow_PeExplorer())
  1738.   BindMenuEvent(#Menu_Window_PeExplorer,#MenuItem_SelectFile,@SelectaFile_PeExplorer())
  1739.   BindMenuEvent(#Menu_Window_PeExplorer,#MenuItem_Exit,@CloseWindow_PeExplorer())
  1740.   BindGadgetEvent(#Gadget_Tree_PeExplorer,@PeGetInfo_PeExplorer(),#PB_EventType_LeftClick )
  1741.   SetGadgetState(#Gadget_Splitter_PeExplorer, 300)
  1742. EndProcedure
  1743.  
  1744. OpenWindow_PeExplorer()
  1745. LoadPlugins_PeExplorer()
  1746.  
  1747. If ProgramParameter(0)
  1748.   PeSetInfo_PeExplorer(ProgramParameter(0))
  1749. EndIf
  1750.  
  1751. While WaitWindowEvent() <> #PB_Event_CloseWindow:Wend
  1752. If pIPersistFile:pIPersistFile\Release():EndIf
  1753. If pIShellLink:pIShellLink\Release():EndIf
  1754.  
  1755. DataSection
  1756.   CLSID_ShellLink:
  1757.   Data.l $00021401
  1758.   Data.w $0000
  1759.   Data.w $0000
  1760.   Data.b $C0,$00,$00,$00,$00,$00,$00,$46
  1761.   IID_IShellLink:
  1762.   Data.l $000214F9
  1763.   Data.w $0000
  1764.   Data.w $0000
  1765.   Data.b $C0,$00,$00,$00,$00,$00,$00,$46
  1766.   IID_IPersistFile:
  1767.   Data.l $0000010b
  1768.   Data.w $0000
  1769.   Data.w $0000
  1770.   Data.b $C0,$00,$00,$00,$00,$00,$00,$46
  1771. EndDataSection
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!