celtic18889

Untitled

Dec 22nd, 2017
719
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. IncludeFile "Pb_PeExplorer.Pbi"
  2.  
  3. Structure VS_VERSION_INFO
  4.   wLength.u;
  5.   wValueLength.u;
  6.   wType.u       ;
  7.   szKey.u[15]   ;
  8.   Padding1.u[2] ;
  9.   Value.VS_FIXEDFILEINFO;
  10.                         ;   Padding2.u            ;
  11.                         ;   Children.u            ;
  12. EndStructure
  13.  
  14. Macro HiWord(a)
  15.   (a>>16 & $ffff)
  16. EndMacro
  17.  
  18. Macro LowWord(a)
  19.   (a & $ffff)
  20. EndMacro
  21.  
  22. EnableExplicit
  23.  
  24. CoInitializeEx_(0, #COINIT_MULTITHREADED)
  25. Global pIShellLink.IShellLinkW
  26. Global pIPersistFile.IPersistFile
  27. If CoCreateInstance_(?CLSID_ShellLink, 0,
  28.                      #CLSCTX_INPROC_SERVER, ?IID_IShellLink, @pIShellLink) = 0
  29.   pIShellLink\QueryInterface(?IID_IPersistFile , @pIPersistFile)
  30. EndIf
  31.  
  32. #File_Info="File Info"
  33. #DOS_HEADER="DOS_HEADER"
  34. #IMAGE_NT_HEADERS="IMAGE_NT_HEADERS"
  35. #FILE_HEADER="FILE_HEADER"
  36. #OPTIONAL_HEADER="OPTIONAL_HEADER"
  37. #SECTION_HEADER="SECTION_HEADER"
  38. #DESCRIPTOR_IMPORT="DESCRIPTOR_IMPORT"
  39. #DESCRIPTOR_EXPORT="DESCRIPTOR_EXPORT"
  40. #DESCRIPTOR_RESOURCE="DESCRIPTOR_RESOURCE"
  41. #DESCRIPTOR_RELOCATION="DESCRIPTOR_RELOCATION"
  42. #ENDOFDATA="+Overlay"
  43.  
  44. Enumeration Window_PeExplorer
  45.   #Window_PeExplorer
  46. EndEnumeration
  47.  
  48. Enumeration Window_Gadget_PeExplorer
  49.   #Gadget_ListIcon_PeExplorer
  50.   #Gadget_Tree_PeExplorer
  51.   #Gadget_Splitter_PeExplorer
  52. EndEnumeration
  53.  
  54. Enumeration FormMenu_PeExplorer
  55.   #Menu_Window_PeExplorer
  56. EndEnumeration
  57.  
  58. Enumeration FormMenuItem_PeExplorer
  59.   #MenuItem_SelectFile
  60.   #MenuItem_Exit
  61. EndEnumeration
  62.  
  63. Enumeration FormStatusBar_PeExplorer
  64.   #StatusBar_PeExplorer
  65. EndEnumeration
  66.  
  67. Enumeration FormStatusBarItem_PeExplorer
  68.   #StatusBarItem_PeInfo
  69.   #StatusBarItem_PeProgress
  70. EndEnumeration
  71.  
  72. Global CurrentPB_PEExplorerFile.PB_PEExplorer
  73. Global CurrentFileLoc.s{#MAX_PATH}
  74.  
  75. Procedure.s GetFilePathFromLnk(Lnk.s)
  76.   Protected pWIN32_FIND_DATA.WIN32_FIND_DATA
  77.   Protected Path.s{#MAX_PATH}
  78.   If pIPersistFile And pIShellLink
  79.     If pIPersistFile\Load(Lnk,0) = 0
  80.       If pIShellLink\GetPath(@Path,#MAX_PATH*2,@pWIN32_FIND_DATA,1) = 0
  81.         ProcedureReturn Path
  82.       EndIf
  83.     EndIf
  84.   EndIf
  85. EndProcedure
  86. Procedure.s GetLongPathName(lpszShortPath.s)
  87.   Protected lpszLongPath.s{#MAX_PATH}
  88.   GetLongPathName_(@lpszShortPath,@lpszLongPath,#MAX_PATH)
  89.   ProcedureReturn lpszLongPath
  90. EndProcedure
  91. Procedure.s GetShortPathName(lpszLongPath.s)
  92.   Protected lpszShortPath.s{#MAX_PATH}
  93.   GetShortPathName_(@lpszLongPath,@lpszShortPath,#MAX_PATH)
  94.   ProcedureReturn lpszShortPath
  95. EndProcedure
  96. Procedure.s FindFile(Pthdll$,aDll$,SubDirCount.l=0,Pcall.b=1)
  97.   Protected iReturn$,DirectoryEntryName$
  98.   Protected ed=ExamineDirectory(#PB_Any, Pthdll$, "*.*")  
  99.   If ed
  100.     While NextDirectoryEntry(ed)
  101.       DirectoryEntryName$=DirectoryEntryName(ed)
  102.       If DirectoryEntryType(ed) = #PB_DirectoryEntry_File
  103.         If  FindString(DirectoryEntryName$, aDll$,1,#PB_String_NoCase)
  104.           iReturn$ = Pthdll$ + "\" + aDll$
  105.         EndIf
  106.       ElseIf SubDirCount < 5
  107.         If DirectoryEntryName$="." Or DirectoryEntryName$=".." :Continue:EndIf
  108.         SubDirCount+1
  109.         iReturn$=FindFile(Pthdll$+"\" + DirectoryEntryName$,aDll$,SubDirCount,0)
  110.       Else
  111.         If Pcall=1
  112.           SubDirCount=0
  113.         EndIf
  114.       EndIf
  115.       If iReturn$:Break:EndIf
  116.     Wend
  117.     FinishDirectory(ed)
  118.   EndIf
  119.   ProcedureReturn iReturn$
  120. EndProcedure
  121.  
  122. Macro AddList(strlist,s)
  123.   AddElement(strlist):strlist = s
  124. EndMacro
  125. Procedure ResizeGadgetsWindow_PeExplorer()
  126.   Protected FormWindowWidth, FormWindowHeight
  127.   FormWindowWidth = WindowWidth(#Window_PeExplorer)
  128.   FormWindowHeight = WindowHeight(#Window_PeExplorer)
  129.   ResizeGadget(#Gadget_Splitter_PeExplorer, 5, 5, FormWindowWidth-10, FormWindowHeight - MenuHeight() - StatusBarHeight(#StatusBar_PeExplorer) - 10)
  130. EndProcedure
  131. Procedure CloseWindow_PeExplorer()
  132.   PostEvent(#PB_Event_CloseWindow, #Window_PeExplorer, 0)
  133. EndProcedure
  134.  
  135. Procedure LoadPlugins_PeExplorer()
  136.   Protected ed=ExamineDirectory(#PB_Any, "Plugins", "*.dll")  
  137.   If ed
  138.     While NextDirectoryEntry(ed)
  139.       If DirectoryEntryType(ed) = #PB_DirectoryEntry_File
  140.         Protected ol=OpenLibrary(#PB_Any,"Plugins\"+DirectoryEntryName(ed))
  141.         If ol
  142.           If Not CallFunction(ol,"PeExplorer_Plugin_Ini",WindowID(#Window_PeExplorer),@CurrentFileLoc)
  143.             CloseLibrary(ol)
  144.           EndIf
  145.         EndIf
  146.       EndIf
  147.     Wend
  148.     FinishDirectory(ed)
  149.   EndIf
  150. EndProcedure
  151.  
  152. Procedure.s Pex_Hex_Value(Value.q,Type.l, Addx.s="0x")
  153.   Protected slong.l
  154.   Select Type
  155.     Case #PB_Byte
  156.       slong=2
  157.     Case #PB_Word
  158.       slong=4
  159.     Case #PB_Long
  160.       slong=8
  161.     Case #PB_Quad
  162.       slong=16
  163.   EndSelect
  164.   ProcedureReturn Addx+RSet (Hex(Value,Type),slong,"0")
  165. EndProcedure
  166. Procedure.s Pex_Resource_Type (nRes.u)
  167.   Select nRes
  168.     Case #RT_ACCELERATOR:ProcedureReturn "#RT_ACCELERATOR"
  169.     Case #RT_ANICURSOR:ProcedureReturn "#RT_ANICURSOR"
  170.     Case #RT_ANIICON:ProcedureReturn "#RT_ANIICON"
  171.     Case #RT_BITMAP:ProcedureReturn "#RT_BITMAP"
  172.     Case #RT_CURSOR:ProcedureReturn "#RT_CURSOR"
  173.     Case #RT_DIALOG:ProcedureReturn "#RT_DIALOG"
  174.     Case #RT_DLGINCLUDE:ProcedureReturn "#RT_DLGINCLUDE"
  175.     Case #RT_FONT:ProcedureReturn "#RT_FONT"
  176.     Case #RT_FONTDIR:ProcedureReturn "#RT_FONTDIR"
  177.     Case #RT_GROUP_CURSOR:ProcedureReturn "#RT_GROUP_CURSOR"
  178.     Case #RT_GROUP_ICON:ProcedureReturn "#RT_GROUP_ICON"
  179.     Case #RT_HTML:ProcedureReturn "#RT_HTML"
  180.     Case #RT_ICON:ProcedureReturn "#RT_ICON"
  181.     Case #RT_MANIFEST:ProcedureReturn "#RT_MANIFEST"
  182.     Case #RT_MENU:ProcedureReturn "#RT_MENU"
  183.     Case #RT_MESSAGETABLE:ProcedureReturn "#RT_MESSAGETABLE"
  184.     Case #RT_PLUGPLAY:ProcedureReturn "#RT_PLUGPLAY"
  185.     Case #RT_RCDATA:ProcedureReturn "#RT_RCDATA"
  186.     Case #RT_STRING:ProcedureReturn "#RT_STRING"
  187.     Case #RT_VERSION:ProcedureReturn "#RT_VERSION"
  188.     Case #RT_VXD:ProcedureReturn "#RT_VXD"
  189.   EndSelect
  190.   ProcedureReturn Str(nRes)
  191. EndProcedure
  192. Procedure.s Pex_Machine_Type(Machine.u)
  193.   Select Machine
  194.     Case #IMAGE_FILE_MACHINE_I386:ProcedureReturn "X86"
  195.     Case #IMAGE_FILE_MACHINE_IA64:ProcedureReturn "Intel Itanium"
  196.     Case #IMAGE_FILE_MACHINE_AMD64:ProcedureReturn "X64"
  197.   EndSelect
  198. EndProcedure
  199. Procedure.s Pex_Exe_Type(Characteristics.u)
  200.   If Characteristics &#IMAGE_FILE_DLL = #IMAGE_FILE_DLL
  201.     ProcedureReturn "Image is a DLL"
  202.   ElseIf Characteristics &#IMAGE_FILE_EXECUTABLE_IMAGE = #IMAGE_FILE_EXECUTABLE_IMAGE
  203.     ProcedureReturn "Image is a EXE"
  204.   EndIf
  205. EndProcedure
  206. Procedure.s Pex_Image_Type(Magic.u)
  207.   Select Magic
  208.     Case #IMAGE_NT_OPTIONAL_HDR32_MAGIC
  209.       ProcedureReturn "32bit"
  210.     Case #IMAGE_NT_OPTIONAL_HDR64_MAGIC
  211.       ProcedureReturn "64bit"
  212.     Case #IMAGE_ROM_OPTIONAL_HDR_MAGIC
  213.       ProcedureReturn "Rom image"
  214.   EndSelect
  215. EndProcedure
  216.  
  217. Structure ImageFile_Type
  218.   Characteristics.u
  219.   Desc.s
  220. EndStructure
  221.  
  222. Procedure.s Pex_ImageFile_Type(Characteristics.w)
  223.   Dim aImageFile_Type.ImageFile_Type(14)
  224.  
  225.   aImageFile_Type(0)\Characteristics = #IMAGE_FILE_RELOCS_STRIPPED
  226.   aImageFile_Type(1)\Characteristics = #IMAGE_FILE_EXECUTABLE_IMAGE
  227.   aImageFile_Type(2)\Characteristics = #IMAGE_FILE_LINE_NUMS_STRIPPED
  228.   aImageFile_Type(3)\Characteristics = #IMAGE_FILE_LOCAL_SYMS_STRIPPED
  229.   aImageFile_Type(4)\Characteristics = #IMAGE_FILE_AGGRESIVE_WS_TRIM
  230.   aImageFile_Type(5)\Characteristics = #IMAGE_FILE_LARGE_ADDRESS_AWARE
  231.   aImageFile_Type(6)\Characteristics = #IMAGE_FILE_BYTES_REVERSED_LO
  232.   aImageFile_Type(7)\Characteristics = #IMAGE_FILE_32BIT_MACHINE
  233.   aImageFile_Type(8)\Characteristics = #IMAGE_FILE_DEBUG_STRIPPED
  234.   aImageFile_Type(9)\Characteristics = #IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
  235.   aImageFile_Type(10)\Characteristics = #IMAGE_FILE_NET_RUN_FROM_SWAP
  236.   aImageFile_Type(11)\Characteristics = #IMAGE_FILE_SYSTEM
  237.   aImageFile_Type(12)\Characteristics = #IMAGE_FILE_DLL
  238.   aImageFile_Type(13)\Characteristics = #IMAGE_FILE_UP_SYSTEM_ONLY
  239.   aImageFile_Type(14)\Characteristics = #IMAGE_FILE_BYTES_REVERSED_HI
  240.   aImageFile_Type(0)\Desc = "IMAGE_FILE_RELOCS_STRIPPED"
  241.   aImageFile_Type(1)\Desc = "IMAGE_FILE_EXECUTABLE_IMAGE"
  242.   aImageFile_Type(2)\Desc = "IMAGE_FILE_LINE_NUMS_STRIPPED"
  243.   aImageFile_Type(3)\Desc = "IMAGE_FILE_LOCAL_SYMS_STRIPPED"
  244.   aImageFile_Type(4)\Desc = "IMAGE_FILE_AGGRESIVE_WS_TRIM"
  245.   aImageFile_Type(5)\Desc = "IMAGE_FILE_LARGE_ADDRESS_AWARE"
  246.   aImageFile_Type(6)\Desc = "IMAGE_FILE_BYTES_REVERSED_LO"
  247.   aImageFile_Type(7)\Desc = "IMAGE_FILE_32BIT_MACHINE"
  248.   aImageFile_Type(8)\Desc = "IMAGE_FILE_DEBUG_STRIPPED"
  249.   aImageFile_Type(9)\Desc = "IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP"
  250.   aImageFile_Type(10)\Desc = "IMAGE_FILE_NET_RUN_FROM_SWAP"
  251.   aImageFile_Type(11)\Desc = "IMAGE_FILE_SYSTEM"
  252.   aImageFile_Type(12)\Desc = "IMAGE_FILE_DLL"
  253.   aImageFile_Type(13)\Desc = "IMAGE_FILE_UP_SYSTEM_ONLY"
  254.   aImageFile_Type(14)\Desc = "IMAGE_FILE_BYTES_REVERSED_HI"
  255.  
  256.   Protected sReturn.s,o
  257.   For o = 0 To 14
  258.     If aImageFile_Type(o)\Characteristics & Characteristics = aImageFile_Type(o)\Characteristics
  259.       sReturn + aImageFile_Type(o)\Desc + " | "
  260.     EndIf
  261.   Next
  262.   ProcedureReturn Mid(sReturn,1,Len(sReturn) - 3)
  263. EndProcedure
  264.  
  265. Procedure.s Pex_Subsystem_Type(Subsystem.u)
  266.   Select Subsystem
  267.     Case #IMAGE_SUBSYSTEM_NATIVE
  268.       ProcedureReturn "Subsystem : native"
  269.     Case #IMAGE_SUBSYSTEM_WINDOWS_GUI
  270.       ProcedureReturn "Subsystem : Windows GUI"
  271.     Case #IMAGE_SUBSYSTEM_WINDOWS_CUI
  272.       ProcedureReturn "Subsystem : Windows CUI"
  273.     Case #IMAGE_SUBSYSTEM_OS2_CUI
  274.       ProcedureReturn "Subsystem :  OS2."
  275.     Case #IMAGE_SUBSYSTEM_POSIX_CUI
  276.       ProcedureReturn "Subsystem :  Posix."
  277.     Case #IMAGE_SUBSYSTEM_WINDOWS_CE_GUI
  278.       ProcedureReturn "Subsystem :  Windows CE."
  279.     Case #IMAGE_SUBSYSTEM_EFI_APPLICATION
  280.       ProcedureReturn "Subsystem :  Extensible Firmware Interface."
  281.     Case #IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER
  282.       ProcedureReturn "Subsystem :  Extensible Firmware Interface."
  283.     Case #IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER
  284.       ProcedureReturn "Subsystem :  Extensible Firmware Interface."
  285.     Case #IMAGE_SUBSYSTEM_EFI_ROM
  286.       ProcedureReturn "Subsystem :  Extensible Firmware Interface."
  287.     Case #IMAGE_SUBSYSTEM_XBOX
  288.       ProcedureReturn "Subsystem : Xbox."
  289.     Case #IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION
  290.       ProcedureReturn "Subsystem :  Boot Application."
  291.     Default
  292.       ProcedureReturn "unknown Subsystem"
  293.   EndSelect
  294. EndProcedure
  295. Procedure.s Pex_Dll_Characteristics(DllCharacteristics.u)
  296.   Select DllCharacteristics
  297.     Case  #IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
  298.       ProcedureReturn "The DLL can be relocated at load time."
  299.     Case #IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
  300.       ProcedureReturn "Code integrity checks are forced."
  301.     Case #IMAGE_DLLCHARACTERISTICS_NX_COMPAT
  302.       ProcedureReturn "The image is compatible With Data execution prevention (DEP)."
  303.     Case #IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
  304.       ProcedureReturn "The image is isolation aware, but should Not be isolated."
  305.     Case   #IMAGE_DLLCHARACTERISTICS_NO_SEH
  306.       ProcedureReturn "The image does Not use structured exception handling (SEH)."
  307.     Case #IMAGE_DLLCHARACTERISTICS_NO_BIND
  308.       ProcedureReturn "Do Not bind the image"
  309.     Case #IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
  310.       ProcedureReturn "A WDM driver"
  311.     Case #IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
  312.       ProcedureReturn "The image is terminal server aware."
  313.   EndSelect
  314. EndProcedure
  315. Procedure.s Pex_HexRawData_Read(ResOffset.l,ResSize.l,ReadSize.l,ReturnHex.b=1)
  316.   Protected Rd = ReadFile(#PB_Any, CurrentFileLoc)
  317.   If Rd
  318.     If ReadSize >= ResSize:ReadSize=ResSize:EndIf
  319.     If ReadSize > 0 And ResOffset > 0 And ResOffset + ReadSize <= Lof(Rd)
  320.       FileSeek(Rd,ResOffset)
  321.       Protected u.l,pb.a,Returna$ ,Returns$
  322.       For u=1 To ReadSize
  323.         pb = ReadAsciiCharacter(Rd)
  324.         Returna$ + Pex_Hex_Value(pb,#PB_Byte,"") + "  "
  325.         If pb=0:pb=Asc("."):EndIf
  326.         Returns$ + Chr(pb)
  327.       Next
  328.     EndIf
  329.     CloseFile(Rd)
  330.   EndIf
  331.   If ReturnHex
  332.     ProcedureReturn Returna$
  333.   EndIf
  334.   ProcedureReturn Returns$
  335. EndProcedure
  336. Procedure.i Pex_MemRawData_Read(ResOffset.l,ReadSize.l)
  337.   Protected Rd = ReadFile(#PB_Any, CurrentFileLoc)
  338.   If Rd
  339.     If ReadSize > 0 And ResOffset > 0 And ResOffset + ReadSize <= Lof(Rd)
  340.       Protected *Almem=AllocateMemory(ReadSize)
  341.       If *Almem
  342.         FileSeek(Rd,ResOffset)
  343.         ReadData(Rd,*Almem,ReadSize)
  344.       EndIf
  345.     EndIf
  346.     CloseFile(Rd)
  347.   EndIf
  348.   ProcedureReturn *Almem
  349. EndProcedure
  350. Procedure.b Pex_UpxPacker_Detect()
  351.   Protected IspUpx.b
  352.   With CurrentPB_PEExplorerFile
  353.     ForEach \IMAGE_SECTION_HEADERList()
  354.       If Left(\IMAGE_SECTION_HEADERList()\__File_Selction_Name,3) = "UPX"
  355.         IspUpx+1
  356.       EndIf
  357.     Next
  358.   EndWith
  359.   ProcedureReturn IspUpx
  360. EndProcedure
  361. Procedure.b Pex_UpxPacker_UnPacked()
  362.   Protected ru,Sortie$,Rderr$
  363.   If MessageRequester("","UPX packer Detected.. "+#CRLF$ + "Do you want decompress file !", #PB_MessageRequester_YesNo)<>#PB_MessageRequester_Yes
  364.     ProcedureReturn
  365.   EndIf
  366.   If FileSize("upx.exe") < 1
  367.     ProcedureReturn MessageRequester("","Upx.exe not found!")
  368.   EndIf
  369.   ru=RunProgram("upx","-d " + GetShortPathName(CurrentFileLoc), GetCurrentDirectory(), #PB_Program_Open | #PB_Program_Read |#PB_Program_Error|#PB_Program_Hide)
  370.   If ru
  371.     While ProgramRunning(ru)
  372.       If AvailableProgramOutput(ru)
  373.         ReadProgramString(ru)
  374.         Rderr$=ReadProgramError(ru)
  375.         If Rderr$
  376.           Sortie$ + Rderr$ + Chr(13)
  377.         EndIf
  378.       EndIf
  379.     Wend
  380.     If ProgramExitCode(ru)=1
  381.       MessageRequester("UPX Error!",Sortie$)
  382.       ProcedureReturn 0
  383.     EndIf
  384.     ProcedureReturn 1
  385.   EndIf
  386. EndProcedure
  387. Procedure.s Pex_DLL_FindPath(aDll$)
  388.   Protected WindowsDirectory.s{#MAX_PATH},SystemWindowsDirectory.s{#MAX_PATH}
  389.   GetWindowsDirectory_(@WindowsDirectory,#MAX_PATH)
  390.   GetSystemDirectory_(@SystemWindowsDirectory,#MAX_PATH)
  391.   If FileSize(WindowsDirectory+"\"+aDll$) > 0
  392.     ProcedureReturn WindowsDirectory+"\"+aDll$
  393.   EndIf
  394.   If FileSize(SystemWindowsDirectory+"\"+aDll$) > 0
  395.     ProcedureReturn SystemWindowsDirectory+"\"+aDll$
  396.   EndIf
  397.   Protected DllPath.s{#MAX_PATH}
  398.   Protected lb,CloseLib.b
  399.   lb=  GetModuleHandle_(aDll$)
  400.   If Not lb
  401.     lb=LoadLibraryEx_(aDll$,0,$00000001)
  402.     CloseLib = 1
  403.   EndIf
  404.   If lb
  405.     GetModuleFileName_(lb,@DllPath,#MAX_PATH)
  406.     If CloseLib
  407.       FreeLibrary_(lb)
  408.     EndIf
  409.     If DllPath
  410.       ProcedureReturn DllPath
  411.     EndIf
  412.   EndIf
  413.   Protected Pthdll$=RTrim(GetPathPart(CurrentFileLoc),"\")
  414.   If Pthdll$
  415.     Protected iFind$=FindFile(Pthdll$,aDll$)
  416.     If iFind$
  417.       ProcedureReturn iFind$
  418.     EndIf
  419.   EndIf
  420.   ProcedureReturn "?\"+aDll$
  421. EndProcedure
  422. Procedure.s Pex_RawData_Hash(ReadOffset.l=0,ReadSize.l=0)
  423.   Protected Rdf=ReadFile(#PB_Any,CurrentFileLoc)
  424.   If Rdf
  425.     If ReadSize=0:ReadSize=Lof(Rdf):EndIf
  426.     If Lof(Rdf) < ReadOffset+ReadSize:ReadSize=Lof(Rdf)-ReadOffset:EndIf
  427.     If ReadSize < 1 :ProcedureReturn:EndIf
  428.     FileSeek(Rdf,ReadOffset)
  429.     Protected *Dataf=AllocateMemory(1024*64)
  430.     If *Dataf
  431.       UseMD5Fingerprint()
  432.       Protected fmd5 = StartFingerprint(#PB_Any, #PB_Cipher_MD5)
  433.       If fmd5
  434.         Protected Rd.l,iReturn$,irds.l=1024*64,ird.l
  435.         Repeat
  436.           If ird+irds > ReadSize:irds=ReadSize-ird:EndIf
  437.           Rd=ReadData(Rdf,*Dataf,irds)
  438.           AddFingerprintBuffer(fmd5, *Dataf, Rd)  
  439.           ird+Rd
  440.           If ird=ReadSize:Break:EndIf
  441.         ForEver
  442.         iReturn$=  FinishFingerprint(fmd5)
  443.       EndIf
  444.       FreeMemory(*Dataf)
  445.     EndIf
  446.     CloseFile(Rdf)
  447.   EndIf
  448.   ProcedureReturn iReturn$
  449. EndProcedure
  450. Procedure.s Pex_Section_Characteristics(Characteristics.l)
  451.   Protected sReturn.s
  452.   If Characteristics& #IMAGE_SCN_CNT_CODE :sReturn + "CODE + ":EndIf
  453.   If Characteristics& #IMAGE_SCN_CNT_INITIALIZED_DATA :sReturn + "INITIALIZED_DATA + ":EndIf
  454.   If Characteristics& #IMAGE_SCN_CNT_UNINITIALIZED_DATA :sReturn + "UNINITIALIZED_DATA + ":EndIf
  455.   If Characteristics& #IMAGE_SCN_MEM_SHARED :sReturn + "MEM_SHARED + ":EndIf
  456.   If Characteristics& #IMAGE_SCN_MEM_EXECUTE :sReturn + "MEM_EXECUTE + ":EndIf
  457.   If Characteristics& #IMAGE_SCN_MEM_READ :sReturn + "MEM_READ + ":EndIf
  458.   If Characteristics& #IMAGE_SCN_MEM_WRITE :sReturn + "MEM_WRITE + ":EndIf
  459.   ProcedureReturn Mid(sReturn,1,Len(sReturn)-2)
  460. EndProcedure
  461. Macro Pex_Is64Bit()
  462.   Bool(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32\OptionalHeader\Magic  = #IMAGE_NT_OPTIONAL_HDR64_MAGIC)
  463. EndMacro
  464. Procedure.s Pex_Date_Format(lDat.l)
  465.   If lDat > 0
  466.     ProcedureReturn FormatDate("%yyyy/ %mm/ %dd %hh:%ii:%ss",lDat)+" UTC"
  467.   EndIf
  468. EndProcedure
  469.  
  470. Procedure Pex_Resource_Read(ResourceDir.l,ResourceNameStr.s,ResourceNameInt.l,ResourceOffset.l,ResourceSize.l)
  471.   Protected sReturn.s
  472.   Select ResourceDir
  473.     Case #RT_MANIFEST
  474.       Protected *Versionmem =Pex_MemRawData_Read(ResourceOffset,ResourceSize)
  475.       If *Versionmem
  476.         sReturn= PeekS(*Versionmem,ResourceSize,#PB_Ascii)
  477.         FreeMemory(*Versionmem)
  478.       EndIf
  479.     Case #RT_VERSION
  480.       *Versionmem =Pex_MemRawData_Read(ResourceOffset,ResourceSize)
  481.       If *Versionmem
  482.         Protected *vr.VS_VERSION_INFO=*Versionmem
  483.         Protected FileVersion.s= Str(HiWord(*vr\Value\dwFileVersionMS)) +
  484.                                  "." +Str(LowWord(*vr\Value\dwFileVersionMS)) +
  485.                                  "." +Str(HiWord(*vr\Value\dwFileVersionLS)) +
  486.                                  "." + Str(LowWord(*vr\Value\dwFileVersionLS))
  487.         Protected ProductVersion.s= Str(HiWord(*vr\Value\dwProductVersionMS)) +
  488.                                     "." +Str(LowWord(*vr\Value\dwProductVersionMS)) +
  489.                                     "." +Str(HiWord(*vr\Value\dwProductVersionLS)) +
  490.                                     "." + Str(LowWord(*vr\Value\dwProductVersionLS))
  491.        
  492.         sReturn + "<" + PeekS(@*vr\szKey)+ ">" + #CRLF$ + #CRLF$
  493.         sReturn + "      File Version: " + FileVersion + #CRLF$
  494.         sReturn + "      Product Version: " + ProductVersion + #CRLF$
  495.         sReturn + "      Characteristics: " + Pex_Hex_Value(*vr\Value\dwFileType,#PB_Long) + ", " + Pex_Hex_Value(*vr\Value\dwFileOS,#PB_Long) + #CRLF$
  496.        
  497.         Protected ChildrenLen.l
  498.         Protected *cvr.VS_VERSION_INFO
  499.         While ChildrenLen < *vr\wLength-SizeOf(VS_VERSION_INFO)
  500.           *cvr = *vr+SizeOf(VS_VERSION_INFO)+ChildrenLen
  501.           ChildrenLen+*cvr\wLength
  502.           If Mod(ChildrenLen,4)
  503.             ChildrenLen+4-Mod(ChildrenLen,4)
  504.           EndIf
  505.           Select PeekS(@*cvr\szKey)
  506.             Case "StringFileInfo"
  507.               Protected *ccvr.VS_VERSION_INFO=*cvr+36
  508.              
  509.               sReturn + #CRLF$ + "      <StringFileInfo>"            
  510.               Protected szKey.s= PeekS(@*ccvr\szKey)
  511.               sReturn + #CRLF$ +  "          <" + szKey + ">" + #CRLF$
  512.               sReturn + "              Language identifier: " + "0x" + Mid(szKey,1,4)+ #CRLF$
  513.               sReturn + "              Code page: " + "0x" + Mid(szKey,3,4)+ #CRLF$ + #CRLF$
  514.              
  515.               Protected iOffset.l,iPadding.l,iLength.l
  516.               While iOffset < *ccvr\wLength - 24
  517.                 Protected *cccvr.VS_VERSION_INFO=*ccvr+24+iOffset
  518.                 iLength=*cccvr\wLength
  519.                 iPadding=Mod(iLength,4)
  520.                 If iPadding:iLength+4-iPadding:EndIf
  521.                 szKey= PeekS(@*cccvr\szKey)
  522.                 iPadding = 4 - Mod(2 * Len(szKey) + 6, 4)
  523.                
  524.                 sReturn + "                  " + szKey + ": " + PeekS(@*cccvr\szKey+(Len(szKey)*2)+iPadding) +#CRLF$
  525.                
  526.                 iOffset+iLength
  527.               Wend
  528.              
  529.               sReturn + #CRLF$ + "          </" + PeekS(@*ccvr\szKey) + ">"
  530.               sReturn + #CRLF$ + "      </StringFileInfo>" + #CRLF$
  531.              
  532.             Case "VarFileInfo"
  533.               *ccvr=*cvr+32
  534.              
  535.               sReturn + #CRLF$ + "      <VarFileInfo>"
  536.               sReturn + #CRLF$ +  "          <" + PeekS(@*ccvr\szKey) + ">" + #CRLF$
  537.              
  538.               Protected i.l,Val.w
  539.               For i=0 To (*ccvr\wValueLength/2)-1
  540.                 Val= PeekW(*ccvr+32+(2*i))
  541.                
  542.                 If Mod(i,2)
  543.                   sReturn + "              Language identifier: " + Pex_Hex_Value(Val,#PB_Word)  + #CRLF$
  544.                 Else
  545.                   sReturn + "              Code page: " + Pex_Hex_Value(Val,#PB_Word)  + #CRLF$                      
  546.                 EndIf
  547.                
  548.               Next
  549.              
  550.               sReturn + #CRLF$ + "          </" + PeekS(@*ccvr\szKey) + ">"
  551.               sReturn + #CRLF$ + "      </VarFileInfo>" + #CRLF$
  552.              
  553.           EndSelect
  554.         Wend
  555.        
  556.         sReturn + #CRLF$ + "</" + PeekS(@*vr\szKey)+ ">" + #CRLF$      
  557.         FreeMemory(*Versionmem)
  558.       EndIf
  559.   EndSelect
  560.   If sReturn
  561.     MessageRequester("", sReturn)
  562.   EndIf
  563. EndProcedure
  564.  
  565. Procedure.s Pex_Reloc_Type(Type.u)
  566.   Protected sReturn.s
  567.   Select Type
  568.     Case #IMAGE_REL_BASED_ABSOLUTE
  569.       sReturn = "IMAGE_REL_BASED_ABSOLUTE(0)"
  570.     Case #IMAGE_REL_BASED_HIGH
  571.       sReturn = "IMAGE_REL_BASED_HIGH(1)"
  572.     Case #IMAGE_REL_BASED_LOW
  573.       sReturn = "IMAGE_REL_BASED_LOW(2)"
  574.     Case #IMAGE_REL_BASED_HIGHLOW
  575.       sReturn = "IMAGE_REL_BASED_HIGHLOW(3)"
  576.     Case #IMAGE_REL_BASED_HIGHADJ
  577.       sReturn = "IMAGE_REL_BASED_HIGHADJ(4)"
  578.     Case #IMAGE_REL_BASED_MIPS_JMPADDR
  579.       sReturn = "IMAGE_REL_BASED_MIPS_JMPADDR(5)"
  580.     Case #IMAGE_REL_BASED_DIR64
  581.       sReturn = "IMAGE_REL_BASED_DIR64(10)"
  582.   EndSelect
  583.   ProcedureReturn sReturn
  584. EndProcedure
  585.  
  586. Procedure SetInfoHeader_PeExplorer(ItHeader.s,SelectType.s="",ResFileType.s="")
  587.   NewList gilist.s()
  588.   Select ItHeader
  589.     Case #DESCRIPTOR_RELOCATION
  590.       If ResFileType <> ""
  591.        
  592.         With CurrentPB_PEExplorerFile
  593.           ForEach \IMAGE_BASE_RELOCATIONList()
  594.             If Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\VirtualAddress,#PB_Long) = SelectType
  595.               Protected SRVA = \IMAGE_BASE_RELOCATIONList()\VirtualAddress
  596.               ForEach \IMAGE_BASE_RELOCATIONList()\RelocationTypeList()
  597.                 If   Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u,#PB_Word) = ResFileType
  598.                   Protected Offset = (\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u & $0fff)
  599.                   Protected Type = ((\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u >> 12) & $000F)
  600.                   AddList(gilist(),"RVA" +Chr(10) + Pex_Hex_Value(Offset +
  601.                                                                   \IMAGE_BASE_RELOCATIONList()\VirtualAddress ,#PB_Long)+Chr(10) +
  602.                                    "Offset : " + Str(Offset))
  603.                   AddList(gilist(),"Type" +Chr(10) +Pex_Reloc_Type(Type))
  604.                   Break
  605.                 EndIf
  606.               Next
  607.             EndIf
  608.           Next
  609.         EndWith
  610.         If Offset
  611.           ForEach CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  612.             With CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  613.               If \VirtualAddress <= SRVA And \VirtualAddress+ \VirtualSize > SRVA
  614.                 Protected *plong.long = Pex_MemRawData_Read(\PointerToRawData + Offset,SizeOf(long))
  615.                 If *plong
  616.                   Protected ImageBase.q = CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32\OptionalHeader\ImageBase
  617.                   If Pex_Is64Bit()
  618.                     ImageBase = CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\ImageBase
  619.                   EndIf
  620.                   Protected RRVA = *plong\l - ImageBase
  621.                   AddList(gilist(),"Data" +Chr(10) +Pex_Hex_Value(*plong\l,#PB_Long) +
  622.                                    Chr(10) + *plong\l)
  623.                   FreeMemory(*plong)
  624.                 EndIf
  625.                 Break
  626.               EndIf
  627.             EndWith
  628.           Next
  629.           If RRVA > 0
  630.             ForEach CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  631.               With CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  632.                 If \VirtualAddress <= RRVA And \VirtualAddress+ \VirtualSize > RRVA
  633.                   AddList(gilist(),"Remote Section " + Chr(10) + \__File_Selction_Name +
  634.                                    Chr(10) + "Remote Offset : " + Str(RRVA))
  635.                   Break
  636.                 EndIf
  637.               EndWith
  638.             Next
  639.           EndIf
  640.         EndIf
  641.       ElseIf SelectType <> ""
  642.        
  643.         With CurrentPB_PEExplorerFile
  644.           ForEach \IMAGE_BASE_RELOCATIONList()
  645.             If Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\VirtualAddress,#PB_Long) = SelectType
  646.               AddList(gilist(),"SizeOfBlock" +Chr(10) + Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\SizeOfBlock,#PB_Long) + Chr(10) +
  647.                                Str(\IMAGE_BASE_RELOCATIONList()\SizeOfBlock) + " Byte")
  648.               AddList(gilist(),"Items" +Chr(10) +Str(ListSize(\IMAGE_BASE_RELOCATIONList()\RelocationTypeList())))
  649.               SRVA = \IMAGE_BASE_RELOCATIONList()\VirtualAddress
  650.               Break
  651.             EndIf
  652.           Next
  653.         EndWith
  654.        
  655.         ForEach CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  656.           With CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  657.             If \VirtualAddress <= SRVA And \VirtualAddress+ \VirtualSize > SRVA
  658.               AddList(gilist(),"Section" +Chr(10) +\__File_Selction_Name)
  659.               Break
  660.             EndIf
  661.           EndWith
  662.         Next
  663.        
  664.       Else
  665.         Protected RelocCount.l
  666.         With CurrentPB_PEExplorerFile
  667.           ForEach \IMAGE_BASE_RELOCATIONList()
  668.             RelocCount+ListSize(\IMAGE_BASE_RELOCATIONList()\RelocationTypeList())
  669.           Next
  670.         EndWith
  671.         AddList(gilist(),"Relocation Count" + Chr(10) + Str(RelocCount))          
  672.       EndIf  
  673.      
  674.     Case#File_Info
  675.       AddList(gilist(),"Name" +Chr(10) + GetFilePart(CurrentFileLoc))
  676.       AddList(gilist(),"Size" +Chr(10) +Str(FileSize(CurrentFileLoc) ) + " Byte")
  677.       AddList(gilist(),"Offset Entry Code" +Chr(10) +
  678.                        Pex_Hex_Value(CurrentPB_PEExplorerFile\__File_OffsetEntryCode,#PB_Long ) +
  679.                        Chr(10) + Str(CurrentPB_PEExplorerFile\__File_OffsetEntryCode))
  680.       AddList(gilist(),"MD5 Hash" +Chr(10) + Pex_RawData_Hash())
  681.      
  682.       With CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32
  683.         StatusBarText(#StatusBar_PeExplorer, #StatusBarItem_PeInfo, (CurrentFileLoc) +
  684.                                                                     "         " +
  685.                                                                     " Made for :" +
  686.                                                                     Pex_Machine_Type(\FileHeader\Machine) +
  687.                                                                     "         " +
  688.                                                                     "  Machine :" +
  689.                                                                     Pex_Image_Type(\OptionalHeader\Magic))
  690.       EndWith
  691.      
  692.     Case #DOS_HEADER
  693.       With CurrentPB_PEExplorerFile\IMAGE_DOS_HEADER
  694.         AddList(gilist(),"e_magic" + Chr(10) + Pex_Hex_Value(\e_magic,#PB_Word) +
  695.                          Chr(10) + Chr(PeekA(@\e_magic)) + Chr(PeekA(@\e_magic+1)))
  696.         AddList(gilist(),"e_cblp" + Chr(10) + Pex_Hex_Value(\e_cblp,#PB_Word))
  697.         AddList(gilist(),"e_cp" + Chr(10) + Pex_Hex_Value(\e_cp,#PB_Word))
  698.         AddList(gilist(),"e_crlc" + Chr(10) + Pex_Hex_Value(\e_crlc,#PB_Word))
  699.         AddList(gilist(),"e_cparhdr" + Chr(10) + Pex_Hex_Value(\e_cparhdr,#PB_Word))
  700.         AddList(gilist(),"e_minalloc" + Chr(10) + Pex_Hex_Value(\e_minalloc,#PB_Word))
  701.         AddList(gilist(),"e_maxalloc" + Chr(10) + Pex_Hex_Value(\e_maxalloc,#PB_Word))
  702.         AddList(gilist(),"e_ss" + Chr(10) + Pex_Hex_Value(\e_ss,#PB_Word))
  703.         AddList(gilist(),"e_sp" + Chr(10) + Pex_Hex_Value(\e_sp,#PB_Word))
  704.         AddList(gilist(),"e_csum" + Chr(10) + Pex_Hex_Value(\e_csum,#PB_Word))
  705.         AddList(gilist(),"e_ip" + Chr(10) + Pex_Hex_Value(\e_ip,#PB_Word))
  706.         AddList(gilist(),"e_cs" + Chr(10) + Pex_Hex_Value(\e_cs,#PB_Word))
  707.         AddList(gilist(),"e_lfarlc" + Chr(10) + Pex_Hex_Value(\e_lfarlc,#PB_Word))
  708.         AddList(gilist(),"e_ovno" + Chr(10) + Pex_Hex_Value(\e_ovno,#PB_Word))
  709.         AddList(gilist(),"e_res[0]" + Chr(10) + Pex_Hex_Value(\e_res[0],#PB_Word))
  710.         AddList(gilist(),"e_res[1]" + Chr(10) + Pex_Hex_Value(\e_res[1],#PB_Word))
  711.         AddList(gilist(),"e_res[2]" + Chr(10) + Pex_Hex_Value(\e_res[2],#PB_Word))
  712.         AddList(gilist(),"e_res[3]" + Chr(10) + Pex_Hex_Value(\e_res[3],#PB_Word))
  713.         AddList(gilist(),"e_oemid" + Chr(10) + Pex_Hex_Value(\e_oemid,#PB_Word))
  714.         AddList(gilist(),"e_oeminfo" + Chr(10) + Pex_Hex_Value(\e_oeminfo,#PB_Word))
  715.         AddList(gilist(),"e_res2[0]" + Chr(10) + Pex_Hex_Value(\e_res2[0],#PB_Word))
  716.         AddList(gilist(),"e_res2[1]" + Chr(10) + Pex_Hex_Value(\e_res2[1],#PB_Word))
  717.         AddList(gilist(),"e_res2[2]" + Chr(10) + Pex_Hex_Value(\e_res2[2],#PB_Word))
  718.         AddList(gilist(),"e_res2[3]" + Chr(10) + Pex_Hex_Value(\e_res2[3],#PB_Word))
  719.         AddList(gilist(),"e_res2[4]" + Chr(10) + Pex_Hex_Value(\e_res2[4],#PB_Word))
  720.         AddList(gilist(),"e_res2[5]" + Chr(10) + Pex_Hex_Value(\e_res2[5],#PB_Word))
  721.         AddList(gilist(),"e_res2[6]" + Chr(10) + Pex_Hex_Value(\e_res2[6],#PB_Word))
  722.         AddList(gilist(),"e_res2[7]" + Chr(10) + Pex_Hex_Value(\e_res2[7],#PB_Word))
  723.         AddList(gilist(),"e_res2[8]" + Chr(10) + Pex_Hex_Value(\e_res2[8],#PB_Word))
  724.         AddList(gilist(),"e_res2[9]" + Chr(10) + Pex_Hex_Value(\e_res2[9],#PB_Word))
  725.         AddList(gilist(),"e_lfanew" + Chr(10) + Pex_Hex_Value(\e_lfanew,#PB_Long))
  726.       EndWith
  727.     Case #IMAGE_NT_HEADERS
  728.       With CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32
  729.         AddList(gilist(),"Signature" + Chr(10) + Pex_Hex_Value(\Signature,#PB_Long)+
  730.                          Chr(10) + Chr(PeekA(@\Signature)) + Chr(PeekA(@\Signature+1)))
  731.       EndWith
  732.     Case #FILE_HEADER
  733.       With CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32\FileHeader
  734.         AddList(gilist(),"Machine" + Chr(10) + Pex_Hex_Value(\Machine,#PB_Word)+ Chr(10) + Pex_Machine_Type(\Machine))
  735.         AddList(gilist(),"NumberOfSections" + Chr(10) + Pex_Hex_Value(\NumberOfSections,#PB_Word) +
  736.                          Chr(10) + Str(\NumberOfSections))
  737.         AddList(gilist(),"TimeDateStamp" + Chr(10) + Pex_Hex_Value(\TimeDateStamp,#PB_Long)+
  738.                          Chr(10) + "Date created : " + Pex_Date_Format(\TimeDateStamp))
  739.         AddList(gilist(),"PointerToSymbolTable" + Chr(10) + Pex_Hex_Value(\PointerToSymbolTable,#PB_Long))
  740.         AddList(gilist(),"NumberOfSymbols" + Chr(10) + Pex_Hex_Value(\NumberOfSymbols,#PB_Long))
  741.         AddList(gilist(),"SizeOfOptionalHeader" + Chr(10) + Pex_Hex_Value(\SizeOfOptionalHeader,#PB_Word) +
  742.                          Chr(10) + Str(\SizeOfOptionalHeader) + " Byte")
  743.         AddList(gilist(),"Characteristics" + Chr(10) + Pex_Hex_Value(\Characteristics,#PB_Word) +
  744.                          Chr(10) + Pex_ImageFile_Type(\Characteristics))
  745.       EndWith
  746.     Case #OPTIONAL_HEADER
  747.       With CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS32\OptionalHeader
  748.         AddList(gilist(),"Magic" + Chr(10) + Pex_Hex_Value(\Magic,#PB_Word)+ Chr(10) + Pex_Image_Type(\Magic))
  749.         AddList(gilist(),"MajorLinkerVersion" + Chr(10) + Pex_Hex_Value(\MajorLinkerVersion,#PB_Byte)+
  750.                          Chr(10) + "Linker Version : " + Str(\MajorLinkerVersion) +"."+ Str( \MinorLinkerVersion))
  751.         AddList(gilist(),"MinorLinkerVersion" + Chr(10) + Pex_Hex_Value(\MinorLinkerVersion,#PB_Byte))
  752.         AddList(gilist(),"SizeOfCode" + Chr(10) + Pex_Hex_Value(\SizeOfCode,#PB_Long)  +
  753.                          Chr(10) + Str(\SizeOfCode) + " Byte")
  754.         AddList(gilist(),"SizeOfInitializedData" + Chr(10) + Pex_Hex_Value(\SizeOfInitializedData,#PB_Long) +
  755.                          Chr(10) + Str(\SizeOfInitializedData) + " Byte")
  756.         AddList(gilist(),"SizeOfUninitializedData" + Chr(10) + Pex_Hex_Value(\SizeOfUninitializedData,#PB_Long) +
  757.                          Chr(10) + Str(\SizeOfUninitializedData) + " Byte")
  758.         AddList(gilist(),"AddressOfEntryPoint" + Chr(10) + Pex_Hex_Value(\AddressOfEntryPoint,#PB_Long) +
  759.                          Chr(10) + Str(\AddressOfEntryPoint))
  760.         AddList(gilist(),"BaseOfCode" + Chr(10) + Pex_Hex_Value(\BaseOfCode,#PB_Long) + Chr(10) + Str(\baseofcode))
  761.         If Pex_Is64Bit()
  762.           AddList(gilist(),"ImageBase" + Chr(10) +
  763.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\ImageBase,#PB_Quad)  +
  764.                            Chr(10) + Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\ImageBase))
  765.         Else
  766.           AddList(gilist(),"BaseOfData" + Chr(10) + Pex_Hex_Value(\BaseOfData,#PB_Long) +
  767.                            Chr(10) + Str(\BaseOfData))  
  768.           AddList(gilist(),"ImageBase" + Chr(10) + Pex_Hex_Value(\ImageBase,#PB_Long) +
  769.                            Chr(10) + Str(\ImageBase))
  770.         EndIf
  771.         AddList(gilist(),"SectionAlignment" + Chr(10) + Pex_Hex_Value(\SectionAlignment,#PB_Long)+
  772.                          Chr(10) + Str(\SectionAlignment))
  773.         AddList(gilist(),"FileAlignment" + Chr(10) + Pex_Hex_Value(\FileAlignment,#PB_Long) +
  774.                          Chr(10) + Str(\FileAlignment))
  775.         AddList(gilist(),"MajorOperatingSystemVersion" + Chr(10) + Pex_Hex_Value(\MajorOperatingSystemVersion,#PB_Word)+
  776.                          Chr(10) + "Required operating system Version :" + Str(\MajorOperatingSystemVersion) +
  777.                          "."+ Str( \MinorOperatingSystemVersion))
  778.         AddList(gilist(),"MinorOperatingSystemVersion" + Chr(10) + Pex_Hex_Value(\MinorOperatingSystemVersion,#PB_Word))
  779.         AddList(gilist(),"MajorImageVersion" + Chr(10) + Pex_Hex_Value(\MajorImageVersion,#PB_Word)+
  780.                          Chr(10) + "Image Version : " + Str(\MajorImageVersion) +"."+ Str( \MinorImageVersion))
  781.         AddList(gilist(),"MinorImageVersion" + Chr(10) + Pex_Hex_Value(\MinorImageVersion,#PB_Word))
  782.         AddList(gilist(),"MajorSubsystemVersion" + Chr(10) + Pex_Hex_Value(\MajorSubsystemVersion,#PB_Word)+
  783.                          Chr(10) + "Subsystem Version : " + Str(\MajorSubsystemVersion) +"."+
  784.                          Str( \MinorSubsystemVersion))
  785.         AddList(gilist(),"MinorSubsystemVersion" + Chr(10) + Pex_Hex_Value(\MinorSubsystemVersion,#PB_Word))
  786.         AddList(gilist(),"Win32VersionValue" + Chr(10) + Pex_Hex_Value(\Win32VersionValue,#PB_Long))
  787.         AddList(gilist(),"SizeOfImage" + Chr(10) + Pex_Hex_Value(\SizeOfImage,#PB_Long) +
  788.                          Chr(10) + Str(\SizeOfImage) + " Byte")
  789.         AddList(gilist(),"SizeOfHeaders" + Chr(10) + Pex_Hex_Value(\SizeOfHeaders,#PB_Long)  +
  790.                          Chr(10) + Str(\SizeOfHeaders) + " Byte")
  791.         AddList(gilist(),"CheckSum" + Chr(10) + Pex_Hex_Value(\CheckSum,#PB_Long))
  792.         AddList(gilist(),"Subsystem" + Chr(10) + Pex_Hex_Value(\Subsystem,#PB_Word)+
  793.                          Chr(10) + Pex_Subsystem_Type(\Subsystem))
  794.         AddList(gilist(),"DllCharacteristics" + Chr(10) + Pex_Hex_Value(\DllCharacteristics,#PB_Word)+
  795.                          Chr(10) + Pex_Dll_Characteristics(\DllCharacteristics))
  796.         If Pex_Is64Bit()
  797.           AddList(gilist(),"SizeOfStackReserve" + Chr(10) +
  798.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfStackReserve,#PB_Quad)+ Chr(10) +
  799.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfStackReserve))
  800.           AddList(gilist(),"SizeOfStackCommit" + Chr(10) + Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfStackCommit,#PB_Quad)+ Chr(10) +
  801.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfStackCommit))
  802.           AddList(gilist(),"SizeOfHeapReserve" + Chr(10) +
  803.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfHeapReserve,#PB_Quad) + Chr(10) +
  804.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfHeapReserve))
  805.           AddList(gilist(),"SizeOfHeapCommit" + Chr(10) +
  806.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfHeapCommit,#PB_Quad) + Chr(10) +
  807.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\SizeOfHeapCommit))
  808.           AddList(gilist(),"LoaderFlags" + Chr(10) +
  809.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\LoaderFlags,#PB_Long) + Chr(10) +
  810.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\LoaderFlags))
  811.           AddList(gilist(),"NumberOfRvaAndSizes" + Chr(10) +
  812.                            Pex_Hex_Value(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\NumberOfRvaAndSizes,#PB_Long) + Chr(10) +
  813.                            Str(CurrentPB_PEExplorerFile\IMAGE_NT_HEADERS64\OptionalHeader\NumberOfRvaAndSizes))
  814.         Else
  815.           AddList(gilist(),"SizeOfStackReserve" + Chr(10) + Pex_Hex_Value(\SizeOfStackReserve,#PB_Long) +
  816.                            Chr(10) + Str(\SizeOfStackReserve))
  817.           AddList(gilist(),"SizeOfStackCommit" + Chr(10) + Pex_Hex_Value(\SizeOfStackCommit,#PB_Long) +
  818.                            Chr(10) + Str(\SizeOfStackCommit))
  819.           AddList(gilist(),"SizeOfHeapReserve" + Chr(10) + Pex_Hex_Value(\SizeOfHeapReserve,#PB_Long) +
  820.                            Chr(10) + Str(\SizeOfHeapReserve))
  821.           AddList(gilist(),"SizeOfHeapCommit" + Chr(10) + Pex_Hex_Value(\SizeOfHeapCommit,#PB_Long) +
  822.                            Chr(10) + Str(\SizeOfHeapCommit))
  823.           AddList(gilist(),"LoaderFlags" + Chr(10) + Pex_Hex_Value(\LoaderFlags,#PB_Long) + Chr(10) +
  824.                            Str(\LoaderFlags))
  825.           AddList(gilist(),"NumberOfRvaAndSizes" + Chr(10) + Pex_Hex_Value(\NumberOfRvaAndSizes,#PB_Long) +
  826.                            Chr(10) + Str(\NumberOfRvaAndSizes))
  827.         EndIf
  828.       EndWith
  829.     Case #SECTION_HEADER
  830.       If SelectType = #SECTION_HEADER
  831.         With CurrentPB_PEExplorerFile
  832.           AddList(gilist(),"Section count" + Chr(10) + Str(ListSize(\IMAGE_SECTION_HEADERList())))
  833.         EndWith
  834.       Else
  835.         ForEach CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  836.           With CurrentPB_PEExplorerFile\IMAGE_SECTION_HEADERList()
  837.             If \__File_Selction_Name = SelectType
  838.               AddList(gilist(),"SecName[8]" + Chr(10) + Pex_Hex_Value(PeekQ(@\SecName),#PB_Quad)+ Chr(10) + SelectType)
  839.               AddList(gilist(),"PhysicalAddr" + Chr(10) + Pex_Hex_Value(\PhysicalAddr,#PB_Long))
  840.               AddList(gilist(),"VirtualSize" + Chr(10) + Pex_Hex_Value(\VirtualSize,#PB_Long) +
  841.                                Chr(10) + Str(\VirtualSize) + " Byte")
  842.               AddList(gilist(),"VirtualAddress" + Chr(10) + Pex_Hex_Value(\VirtualAddress,#PB_Long)  +
  843.                                Chr(10) + Str(\VirtualAddress))
  844.               AddList(gilist(),"SizeOfRawData" + Chr(10) + Pex_Hex_Value(\SizeOfRawData,#PB_Long)  + Chr(10) +
  845.                                Str(\SizeOfRawData) + " Byte")
  846.               AddList(gilist(),"PointerToRawData" + Chr(10) + Pex_Hex_Value(\PointerToRawData,#PB_Long) +
  847.                                Chr(10) + Str(\PointerToRawData))
  848.               AddList(gilist(),"PointerToRelocations" + Chr(10) + Pex_Hex_Value(\PointerToRelocations,#PB_Long))
  849.               AddList(gilist(),"PointerToLinenumbers" + Chr(10) + Pex_Hex_Value(\PointerToLinenumbers,#PB_Long))
  850.               AddList(gilist(),"NumberOfRelocations" + Chr(10) + Pex_Hex_Value(\NumberOfRelocations,#PB_Word))
  851.               AddList(gilist(),"NumberOfLinenumbers" + Chr(10) + Pex_Hex_Value(\NumberOfLinenumbers,#PB_Word))
  852.               AddList(gilist(),"Characteristics" + Chr(10) + Pex_Hex_Value(\Characteristics,#PB_Long)+ Chr(10) +
  853.                                Pex_Section_Characteristics(\Characteristics))
  854.               AddList(gilist(),"")            
  855.               AddList(gilist(),"Section MD5 Hash" + Chr(10) +Pex_RawData_Hash(\PointerToRawData,\SizeOfRawData))
  856.               Break
  857.             EndIf
  858.           EndWith
  859.         Next
  860.       EndIf
  861.     Case #DESCRIPTOR_IMPORT
  862.       If ResFileType <> ""
  863.         Protected fUnctioname$
  864.         With CurrentPB_PEExplorerFile\IMAGE_IMPORT_DESCRIPTORInfo
  865.           ForEach \IMAGE_IMPORT_DESCRIPTORList()
  866.             If \IMAGE_IMPORT_DESCRIPTORList()\LibraryName = SelectType
  867.               ForEach \IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()
  868.                 If \IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\Ordinal
  869.                   If Pex_Is64Bit()
  870.                     fUnctioname$=Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\Ordinal&$ffffff,#PB_Quad)
  871.                   Else
  872.                     fUnctioname$=Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\Ordinal&$ffffff,#PB_Long)            
  873.                   EndIf
  874.                 Else
  875.                   fUnctioname$= \IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\FunctionName              
  876.                 EndIf
  877.                 If fUnctioname$ = ResFileType
  878.                   If \IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\Ordinal
  879.                     AddList(gilist(),"Ordinal" + Chr(10) + fUnctioname$)
  880.                   Else
  881.                     AddList(gilist(),"Name" + Chr(10) + fUnctioname$)
  882.                   EndIf
  883.                  
  884.                   If Pex_Is64Bit()
  885.                     AddList(gilist(),"IMAGE_THUNK_DATA" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\IMAGE_THUNK_DATA,#PB_Quad))
  886.                   Else
  887.                     AddList(gilist(),"IMAGE_THUNK_DATA" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\IMAGE_THUNK_DATA,#PB_Long))
  888.                   EndIf
  889.                  
  890.                   Break
  891.                 EndIf
  892.               Next
  893.               Break
  894.             EndIf
  895.           Next
  896.         EndWith
  897.       ElseIf SelectType <> ""
  898.         With CurrentPB_PEExplorerFile\IMAGE_IMPORT_DESCRIPTORInfo
  899.           ForEach \IMAGE_IMPORT_DESCRIPTORList()
  900.             If \IMAGE_IMPORT_DESCRIPTORList()\LibraryName = SelectType
  901.               AddList(gilist(),"OriginalFirstThunk" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\OriginalFirstThunk,#PB_Long))
  902.               AddList(gilist(),"TimeDateStamp" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\TimeDateStamp,#PB_Long)+ Chr(10) +
  903.                                "Date : " + Pex_Date_Format(\IMAGE_IMPORT_DESCRIPTORList()\TimeDateStamp))
  904.               AddList(gilist(),"ForwarderChain" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\ForwarderChain,#PB_Long))
  905.               AddList(gilist(),"Name" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\Name,#PB_Long))
  906.               AddList(gilist(),"FirstThunk" + Chr(10) + Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORList()\FirstThunk,#PB_Long))
  907.               Break
  908.             EndIf
  909.           Next
  910.         EndWith      
  911.       Else
  912.         Protected FuncCount.l
  913.         With CurrentPB_PEExplorerFile\IMAGE_IMPORT_DESCRIPTORInfo
  914.           ForEach \IMAGE_IMPORT_DESCRIPTORList()
  915.             FuncCount+ListSize(\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe())
  916.           Next
  917.         EndWith
  918.         AddList(gilist(),"Function Count" + Chr(10) + Str(FuncCount))          
  919.       EndIf
  920.     Case #DESCRIPTOR_EXPORT
  921.       If SelectType <> ""
  922.         With CurrentPB_PEExplorerFile\IMAGE_EXPORT_DIRECTORYInfo
  923.           ForEach \ExportFunctionNameListe()
  924.             If \ExportFunctionNameListe()\FunctionName = SelectType
  925.               AddList(gilist(),"Address" + Chr(10) + Pex_Hex_Value(\ExportFunctionNameListe()\FunctionAddress,#PB_Long))
  926.               AddList(gilist(),"Ordinale" + Chr(10) + Pex_Hex_Value(\ExportFunctionNameListe()\Ordinale,#PB_Word))
  927.               Break
  928.             EndIf
  929.           Next
  930.         EndWith
  931.       Else
  932.         With CurrentPB_PEExplorerFile\IMAGE_EXPORT_DIRECTORYInfo
  933.           AddList(gilist(),"Characteristics" + Chr(10) + Pex_Hex_Value(\Characteristics,#PB_Long))
  934.           AddList(gilist(),"TimeDateStamp" + Chr(10) + Pex_Hex_Value(\TimeDateStamp,#PB_Long)+
  935.                            Chr(10) + "Date : " + Pex_Date_Format(\TimeDateStamp))
  936.           AddList(gilist(),"MajorVersion" + Chr(10) + Pex_Hex_Value(\MajorVersion,#PB_Word)+
  937.                            Chr(10) + Str(\MajorVersion) + "." + Str(\MinorVersion))
  938.           AddList(gilist(),"MinorVersion" + Chr(10) + Pex_Hex_Value(\MinorVersion,#PB_Word))
  939.           AddList(gilist(),"Name" + Chr(10) + Pex_Hex_Value(\Name,#PB_Long)+ Chr(10) + \__File_OriginalDllName)
  940.           AddList(gilist(),"Base" + Chr(10) + Pex_Hex_Value(\Base,#PB_Long))
  941.           AddList(gilist(),"NumberOfFunctions" + Chr(10) + Pex_Hex_Value(\NumberOfFunctions,#PB_Long) +
  942.                            Chr(10) + Str(\NumberOfFunctions))
  943.           AddList(gilist(),"NumberOfNames" + Chr(10) + Pex_Hex_Value(\NumberOfNames,#PB_Long) +
  944.                            Chr(10) + Str(\NumberOfNames))
  945.           AddList(gilist(),"AddressOfFunctions" + Chr(10) + Pex_Hex_Value(\AddressOfFunctions,#PB_Long))
  946.           AddList(gilist(),"AddressOfNames" + Chr(10) + Pex_Hex_Value(\AddressOfNames,#PB_Long))
  947.           AddList(gilist(),"AddressOfNameOrdinals" + Chr(10) + Pex_Hex_Value(\AddressOfNameOrdinals,#PB_Long))
  948.         EndWith
  949.       EndIf
  950.     Case #ENDOFDATA
  951.       With CurrentPB_PEExplorerFile
  952.         AddList(gilist(),"Size" + Chr(10) + Str(FileSize(CurrentFileLoc)-\__File_ImageSize) + " Byte")
  953.         AddList(gilist(),"File Offset" + Chr(10) + Pex_Hex_Value(\__File_ImageSize,#PB_Long) +
  954.                          Chr(10) + Str(\__File_ImageSize))  
  955.         AddList(gilist(),"Frist 30 Byte Of Data" + Chr(10) +
  956.                          Pex_HexRawData_Read(\__File_ImageSize,FileSize(CurrentFileLoc)-\__File_ImageSize,30,1) +
  957.                          Chr(10) + ReplaceString(Pex_HexRawData_Read(\__File_ImageSize,FileSize(CurrentFileLoc)-\__File_ImageSize,30,0),Chr(10),""))
  958.       EndWith
  959.     Case #DESCRIPTOR_RESOURCE
  960.       Protected Cres$,ResnType$
  961.       If SelectType <> ""
  962.         If  ResFileType <> ""
  963.           With CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo
  964.             ForEach \ResourceDirectoryList()
  965.               If \ResourceDirectoryList()\__File_ResourceDirectoryName
  966.                 Cres$= \ResourceDirectoryList()\__File_ResourceDirectoryName
  967.                 ResnType$ = "String"
  968.               Else
  969.                 Cres$ = Pex_Resource_Type(\ResourceDirectoryList()\__File_ResourceDirectoryID)
  970.                 ResnType$ = "Integer"
  971.               EndIf
  972.               If   Cres$ = SelectType
  973.                 ForEach \ResourceDirectoryList()\ResourceSubDirectoryList()
  974.                   If \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName
  975.                     Cres$= \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName
  976.                     ResnType$ = "String"
  977.                   Else
  978.                     Cres$ = Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryID)
  979.                     ResnType$ = "Integer"
  980.                   EndIf
  981.                   If   Cres$ = ResFileType
  982.                     AddList(gilist(),"Characteristics" + Chr(10) +
  983.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\Characteristics,#PB_Long)+
  984.                                      Chr(10) + "Entry Name Type : " + ResnType$);
  985.                     AddList(gilist(),"TimeDateStamp" + Chr(10) +
  986.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\TimeDateStamp,#PB_Long)+
  987.                                      Chr(10) + "Date : " + Pex_Date_Format(\ResourceDirectoryList()\ResourceSubDirectoryList()\TimeDateStamp))      
  988.                     AddList(gilist(),"MajorVersion" + Chr(10) +
  989.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\MajorVersion,#PB_Word)+
  990.                                      Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\MajorVersion) + "." +
  991.                                      Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\MinorVersion))  
  992.                     AddList(gilist(),"MinorVersion" + Chr(10) +
  993.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\MinorVersion,#PB_Word))        
  994.                     AddList(gilist(),"NumberOfNamedEntries" + Chr(10) +
  995.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\NumberOfNamedEntries,#PB_Word)+
  996.                                      Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\NumberOfNamedEntries))
  997.                     AddList(gilist(),"NumberOfIdEntries" + Chr(10) +
  998.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\NumberOfIdEntries,#PB_Word) +
  999.                                      Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\NumberOfIdEntries))
  1000.                     AddList(gilist(),"")            
  1001.                     AddList(gilist(),"File Resource Offset" + Chr(10) +
  1002.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset,#PB_Long)+
  1003.                                      Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset))
  1004.                     AddList(gilist(),"OffsetToData" + Chr(10) +
  1005.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\OffsetToData,#PB_Long))
  1006.                     AddList(gilist(),"Size" + Chr(10) + Str(\ResourceDirectoryList()\ResourceSubDirectoryList()\Size) + " Byte")
  1007.                     AddList(gilist(),"CodePage" + Chr(10) +
  1008.                                      Pex_Hex_Value(\ResourceDirectoryList()\ResourceSubDirectoryList()\CodePage,#PB_Long))
  1009.                     AddList(gilist(),"Frist 30 Byte Of resource" + Chr(10) +
  1010.                                      Pex_HexRawData_Read(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset,\ResourceDirectoryList()\ResourceSubDirectoryList()\Size,30) +
  1011.                                      Chr(10) + ReplaceString(Pex_HexRawData_Read(\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset,\ResourceDirectoryList()\ResourceSubDirectoryList()\Size,30,0),Chr(10),""))
  1012.                    
  1013.                     Pex_Resource_Read(\ResourceDirectoryList()\__File_ResourceDirectoryID,
  1014.                                       \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName,
  1015.                                       \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryID,
  1016.                                       \ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceOffset,
  1017.                                       \ResourceDirectoryList()\ResourceSubDirectoryList()\Size)
  1018.                    
  1019.                     Break
  1020.                   EndIf
  1021.                 Next
  1022.                 Break
  1023.               EndIf
  1024.             Next
  1025.           EndWith
  1026.         Else
  1027.           ForEach CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()
  1028.             If CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName
  1029.               Cres$= CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName
  1030.               ResnType$ = "String"
  1031.             Else
  1032.               Cres$ = Pex_Resource_Type(CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryID)
  1033.               ResnType$ = "Integer"
  1034.             EndIf
  1035.             If   Cres$ = SelectType
  1036.               With CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()
  1037.                 AddList(gilist(),"Characteristics" + Chr(10) +
  1038.                                  Pex_Hex_Value(\Characteristics,#PB_Long)+ Chr(10) + "Entry Name Type : " + ResnType$);
  1039.                 AddList(gilist(),"TimeDateStamp" + Chr(10) +
  1040.                                  Pex_Hex_Value(\TimeDateStamp,#PB_Long)+ Chr(10) + "Date : " +
  1041.                                  Pex_Date_Format(\TimeDateStamp))      
  1042.                 AddList(gilist(),"MajorVersion" + Chr(10) +
  1043.                                  Pex_Hex_Value(\MajorVersion,#PB_Word)+ Chr(10) +
  1044.                                  Str(\MajorVersion) + "." + Str(\MinorVersion))  
  1045.                 AddList(gilist(),"MinorVersion" + Chr(10) + Pex_Hex_Value(\MinorVersion,#PB_Word))        
  1046.                 AddList(gilist(),"NumberOfNamedEntries" + Chr(10) + Pex_Hex_Value(\NumberOfNamedEntries,#PB_Word) +
  1047.                                  Chr(10) + Str(\NumberOfNamedEntries))
  1048.                 AddList(gilist(),"NumberOfIdEntries" + Chr(10) + Pex_Hex_Value(\NumberOfIdEntries,#PB_Word) +
  1049.                                  Chr(10) + Str(\NumberOfIdEntries))
  1050.               EndWith
  1051.               Break
  1052.             EndIf
  1053.           Next
  1054.         EndIf
  1055.       Else
  1056.         With CurrentPB_PEExplorerFile\IMAGE_RESOURCE_DIRECTORYInfo
  1057.           AddList(gilist(),"Characteristics" + Chr(10) + Pex_Hex_Value(\Characteristics,#PB_Long));
  1058.           AddList(gilist(),"TimeDateStamp" + Chr(10) + Pex_Hex_Value(\TimeDateStamp,#PB_Long)+
  1059.                            Chr(10) + "Date : " + Pex_Date_Format(\TimeDateStamp))      
  1060.           AddList(gilist(),"MajorVersion" + Chr(10) +
  1061.                            Pex_Hex_Value(\MajorVersion,#PB_Word)+ Chr(10) + Str(\MajorVersion) + "." +
  1062.                            Str(\MinorVersion))  
  1063.           AddList(gilist(),"MinorVersion" + Chr(10) + Pex_Hex_Value(\MinorVersion,#PB_Word))        
  1064.           AddList(gilist(),"NumberOfNamedEntries" + Chr(10) + Pex_Hex_Value(\NumberOfNamedEntries,#PB_Word) +
  1065.                            Chr(10) + Str(\NumberOfNamedEntries))
  1066.           AddList(gilist(),"NumberOfIdEntries" + Chr(10) + Pex_Hex_Value(\NumberOfIdEntries,#PB_Word) +
  1067.                            Chr(10) + Str(\NumberOfIdEntries))
  1068.         EndWith
  1069.       EndIf
  1070.   EndSelect
  1071.   ForEach gilist()
  1072.     AddGadgetItem(#Gadget_ListIcon_PeExplorer,-1,gilist())
  1073.   Next
  1074. EndProcedure
  1075.  
  1076. Procedure PeGetInfo_PeExplorer()
  1077.   Protected Sttree = GetGadgetState(#Gadget_Tree_PeExplorer)
  1078.   If Sttree = -1 :ProcedureReturn:EndIf
  1079.   Protected gettreeTxt$ = GetGadgetItemText(#Gadget_Tree_PeExplorer,Sttree)
  1080.   Protected t.l,Selectednode$,PerSdir$
  1081.   ClearGadgetItems(#Gadget_ListIcon_PeExplorer)
  1082.   Select gettreeTxt$
  1083.     Case #ENDOFDATA
  1084.       SetInfoHeader_PeExplorer(#ENDOFDATA)
  1085.     Case #File_Info
  1086.       SetInfoHeader_PeExplorer(#File_Info)
  1087.     Case #FILE_HEADER, #OPTIONAL_HEADER
  1088.       SetInfoHeader_PeExplorer(gettreeTxt$)
  1089.     Default
  1090.       For t=Sttree To 0 Step -1
  1091.         If GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, t, #PB_Tree_SubLevel) = 2
  1092.           If PerSdir$ =""
  1093.             PerSdir$=  GetGadgetItemText(#Gadget_Tree_PeExplorer,t)
  1094.           EndIf
  1095.         EndIf
  1096.         If GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, t, #PB_Tree_SubLevel) = 1
  1097.           Selectednode$=  GetGadgetItemText(#Gadget_Tree_PeExplorer,t)
  1098.           Break
  1099.         EndIf
  1100.       Next
  1101.       Select Selectednode$
  1102.         Case #DESCRIPTOR_RESOURCE
  1103.           If gettreeTxt$ = #DESCRIPTOR_RESOURCE
  1104.             SetInfoHeader_PeExplorer(#DESCRIPTOR_RESOURCE)
  1105.           Else  
  1106.             If GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, Sttree, #PB_Tree_SubLevel) = 2
  1107.               SetInfoHeader_PeExplorer(#DESCRIPTOR_RESOURCE,gettreeTxt$)
  1108.             Else
  1109.               SetInfoHeader_PeExplorer(#DESCRIPTOR_RESOURCE, PerSdir$,gettreeTxt$)
  1110.             EndIf
  1111.           EndIf
  1112.         Case #DESCRIPTOR_EXPORT
  1113.           If gettreeTxt$ = #DESCRIPTOR_EXPORT
  1114.             SetInfoHeader_PeExplorer(#DESCRIPTOR_EXPORT)
  1115.           Else
  1116.             SetInfoHeader_PeExplorer(#DESCRIPTOR_EXPORT,gettreeTxt$)
  1117.           EndIf
  1118.         Case #DESCRIPTOR_IMPORT
  1119.           If gettreeTxt$ = #DESCRIPTOR_IMPORT
  1120.             SetInfoHeader_PeExplorer(#DESCRIPTOR_IMPORT)
  1121.           ElseIf GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, Sttree, #PB_Tree_SubLevel) = 2
  1122.             SetInfoHeader_PeExplorer(#DESCRIPTOR_IMPORT,GetFilePart(gettreeTxt$))
  1123.           Else
  1124.             SetInfoHeader_PeExplorer(#DESCRIPTOR_IMPORT,GetFilePart(PerSdir$),gettreeTxt$)
  1125.           EndIf
  1126.          
  1127.         Case #DESCRIPTOR_RELOCATION
  1128.           If gettreeTxt$ = #DESCRIPTOR_RELOCATION
  1129.             SetInfoHeader_PeExplorer(#DESCRIPTOR_RELOCATION)
  1130.           ElseIf GetGadgetItemAttribute(#Gadget_Tree_PeExplorer, Sttree, #PB_Tree_SubLevel) = 2
  1131.             SetInfoHeader_PeExplorer(#DESCRIPTOR_RELOCATION,GetFilePart(gettreeTxt$))
  1132.           Else
  1133.             SetInfoHeader_PeExplorer(#DESCRIPTOR_RELOCATION,GetFilePart(PerSdir$),gettreeTxt$)
  1134.           EndIf
  1135.          
  1136.         Default
  1137.           SetInfoHeader_PeExplorer(Selectednode$,gettreeTxt$)
  1138.       EndSelect
  1139.   EndSelect
  1140. EndProcedure
  1141.  
  1142. Procedure PeSetInfo_PeExplorer(FilePath.s)
  1143.   If UCase(GetExtensionPart(FilePath)) = "LNK"
  1144.     FilePath = GetFilePathFromLnk(FilePath)
  1145.     If FilePath = "":MessageRequester("","Unable to open file!"):ProcedureReturn 0:EndIf
  1146.   EndIf
  1147.   FilePath = GetLongPathName(FilePath)
  1148.   Protected tPB_PEExplorerFile.PB_PEExplorer
  1149.   Protected RdExe = ReadFile(#PB_Any, FilePath); open pe file to read
  1150.   If Not RdExe:MessageRequester("","Unable to open file!"):ProcedureReturn 0:EndIf
  1151.   If Pb_PEExplorer(RdExe ,@tPB_PEExplorerFile) = 0:CloseFile(RdExe)
  1152.     MessageRequester("","Error Get Pe Info!")
  1153.   ProcedureReturn:EndIf
  1154.   StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 40)
  1155.   CloseFile(RdExe)
  1156.   ClearStructure(@CurrentPB_PEExplorerFile,PB_PEExplorer)
  1157.   CurrentPB_PEExplorerFile=tPB_PEExplorerFile
  1158.   CurrentFileLoc = FilePath
  1159.   ClearGadgetItems(#Gadget_Tree_PeExplorer)
  1160.   ClearGadgetItems(#Gadget_ListIcon_PeExplorer)
  1161.   With CurrentPB_PEExplorerFile
  1162.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#File_Info)
  1163.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DOS_HEADER,0,1)
  1164.     SetGadgetItemState(#Gadget_Tree_PeExplorer, 0, #PB_Tree_Expanded)
  1165.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#IMAGE_NT_HEADERS,0,1)
  1166.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#FILE_HEADER,0,2)
  1167.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#OPTIONAL_HEADER,0,2)
  1168.     SetGadgetItemState(#Gadget_Tree_PeExplorer, 2, #PB_Tree_Expanded)
  1169.     AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#SECTION_HEADER,0,1)
  1170.     ForEach \IMAGE_SECTION_HEADERList()
  1171.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_SECTION_HEADERList()\__File_Selction_Name),0,2)
  1172.     Next
  1173.     StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 60)
  1174.     If ListSize(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()) >0
  1175.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DESCRIPTOR_IMPORT,0,1)
  1176.       ForEach \IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()
  1177.         ;         AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\LibraryName),0,2)
  1178.         AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_DLL_FindPath(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\LibraryName),0,2)
  1179.         ForEach \IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()
  1180.           If \IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\Ordinal
  1181.             If Pex_Is64Bit()
  1182.               AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\Ordinal&$ffffff,#PB_Quad),0,3)
  1183.             Else
  1184.               AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Hex_Value(\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\Ordinal&$ffffff,#PB_Long),0,3)                      
  1185.             EndIf
  1186.           Else
  1187.             AddGadgetItem(#Gadget_Tree_PeExplorer,-1,\IMAGE_IMPORT_DESCRIPTORInfo\IMAGE_IMPORT_DESCRIPTORList()\ImportFunctionListe()\FunctionName,0,3)                      
  1188.           EndIf
  1189.         Next
  1190.       Next
  1191.     EndIf
  1192.     StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 70)
  1193.     If ListSize(\IMAGE_BASE_RELOCATIONList()) >0
  1194.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DESCRIPTOR_RELOCATION,0,1)
  1195.       ForEach \IMAGE_BASE_RELOCATIONList()
  1196.         AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\VirtualAddress,#PB_Long),0,2)
  1197.         ForEach \IMAGE_BASE_RELOCATIONList()\RelocationTypeList()
  1198.           AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Hex_Value(\IMAGE_BASE_RELOCATIONList()\RelocationTypeList()\u,#PB_Word),0,3)
  1199.         Next
  1200.       Next
  1201.     EndIf
  1202.     If ListSize(\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()) >0
  1203.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DESCRIPTOR_EXPORT,0,1)
  1204.       ForEach \IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()
  1205.         AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_EXPORT_DIRECTORYInfo\ExportFunctionNameListe()\FunctionName),0,2)
  1206.       Next
  1207.     EndIf
  1208.     StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 80)
  1209.     If ListSize(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()) >0
  1210.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#DESCRIPTOR_RESOURCE,0,1)
  1211.       ForEach \IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()
  1212.         If \IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName
  1213.           AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryName),0,2)
  1214.         Else
  1215.           AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Pex_Resource_Type(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\__File_ResourceDirectoryID),0,2)
  1216.         EndIf
  1217.         ForEach \IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()
  1218.           If \IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName
  1219.             AddGadgetItem(#Gadget_Tree_PeExplorer,-1,(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryName),0,3)
  1220.           Else
  1221.             AddGadgetItem(#Gadget_Tree_PeExplorer,-1,Str(\IMAGE_RESOURCE_DIRECTORYInfo\ResourceDirectoryList()\ResourceSubDirectoryList()\__File_ResourceDirectoryID),0,3)
  1222.           EndIf
  1223.         Next
  1224.       Next
  1225.     EndIf
  1226.     StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 90)
  1227.    
  1228.     If \__File_ImageSize <> FileSize(CurrentFileLoc)
  1229.       AddGadgetItem(#Gadget_Tree_PeExplorer,-1,#ENDOFDATA,0,1)
  1230.     EndIf
  1231.   EndWith
  1232.   StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 100)
  1233.  
  1234.   SetInfoHeader_PeExplorer(#File_Info)
  1235.  
  1236.   SetWindowTitle(#Window_PeExplorer,"PeExplorer v 1.0 [" + GetFilePart(FilePath) + "]")
  1237.  
  1238.   If Pex_UpxPacker_Detect()
  1239.     If Pex_UpxPacker_UnPacked() = 1
  1240.       PeSetInfo_PeExplorer(FilePath)
  1241.     EndIf
  1242.   EndIf
  1243. EndProcedure
  1244.  
  1245. Procedure SelectaFile_PeExplorer()
  1246.   Protected FilePath.s=OpenFileRequester("Select a file...","","Exe or Dll|*.dll;*.exe|All|*.*",0)
  1247.   If FilePath="":ProcedureReturn:EndIf
  1248.   PeSetInfo_PeExplorer(FilePath)
  1249. EndProcedure
  1250.  
  1251. Procedure DropFileWindow_PeExplorer()
  1252.   PeSetInfo_PeExplorer(EventDropFiles())
  1253. EndProcedure
  1254.  
  1255. Procedure OpenWindow_PeExplorer()
  1256.   OpenWindow(#Window_PeExplorer, 0, 0, 820, 465, "PeExplorer v 1.0", #PB_Window_SystemMenu | #PB_Window_MinimizeGadget | #PB_Window_MaximizeGadget | #PB_Window_SizeGadget | #PB_Window_ScreenCentered)
  1257.   CreateStatusBar(  #StatusBar_PeExplorer, WindowID(#Window_PeExplorer))
  1258.   AddStatusBarField(#PB_Ignore)
  1259.   StatusBarText(  #StatusBar_PeExplorer, #StatusBarItem_PeInfo, "Hi " + UserName())
  1260.   AddStatusBarField(50)
  1261.   StatusBarProgress(#StatusBar_PeExplorer, #StatusBarItem_PeProgress, 0)
  1262.   CreateMenu(#Menu_Window_PeExplorer, WindowID(#Window_PeExplorer))
  1263.   MenuTitle("&File")
  1264.   MenuItem(#MenuItem_SelectFile, "&Open a Pe")
  1265.   MenuBar()
  1266.   MenuItem(#MenuItem_Exit, "Exit")
  1267.   MenuTitle("Plugins")
  1268.   MenuTitle("About")
  1269.   TreeGadget(#Gadget_Tree_PeExplorer, 5, 5, 205, 410)
  1270.   ListIconGadget(#Gadget_ListIcon_PeExplorer, 215, 5, 600, 410, "Member", 200)
  1271.   AddGadgetColumn(#Gadget_ListIcon_PeExplorer,1,"Value",200)
  1272.   AddGadgetColumn(#Gadget_ListIcon_PeExplorer,2,"Comment",200)
  1273.   SplitterGadget(#Gadget_Splitter_PeExplorer,5,5,600+205+5,410,#Gadget_Tree_PeExplorer,#Gadget_ListIcon_PeExplorer,#PB_Splitter_Vertical)
  1274.   EnableWindowDrop(#Window_PeExplorer, #PB_Drop_Files, #PB_Drag_Copy)
  1275.   BindEvent(#PB_Event_WindowDrop , @DropFileWindow_PeExplorer())
  1276.   BindEvent(#PB_Event_SizeWindow , @ResizeGadgetsWindow_PeExplorer())
  1277.   BindEvent(#PB_Event_CloseWindow   , @CloseWindow_PeExplorer())
  1278.   BindMenuEvent(#Menu_Window_PeExplorer,#MenuItem_SelectFile,@SelectaFile_PeExplorer())
  1279.   BindMenuEvent(#Menu_Window_PeExplorer,#MenuItem_Exit,@CloseWindow_PeExplorer())
  1280.   BindGadgetEvent(#Gadget_Tree_PeExplorer,@PeGetInfo_PeExplorer(),#PB_EventType_LeftClick )
  1281.   SetGadgetState(#Gadget_Splitter_PeExplorer, 300)
  1282. EndProcedure
  1283.  
  1284. OpenWindow_PeExplorer()
  1285. LoadPlugins_PeExplorer()
  1286.  
  1287. If ProgramParameter(0)
  1288.   PeSetInfo_PeExplorer(ProgramParameter(0))
  1289. EndIf
  1290.  
  1291. While WaitWindowEvent() <> #PB_Event_CloseWindow:Wend
  1292. If pIPersistFile:pIPersistFile\Release():EndIf
  1293. If pIShellLink:pIShellLink\Release():EndIf
  1294.  
  1295. DataSection
  1296.   CLSID_ShellLink:
  1297.   Data.l $00021401
  1298.   Data.w $0000
  1299.   Data.w $0000
  1300.   Data.b $C0,$00,$00,$00,$00,$00,$00,$46
  1301.   IID_IShellLink:
  1302.   Data.l $000214F9
  1303.   Data.w $0000
  1304.   Data.w $0000
  1305.   Data.b $C0,$00,$00,$00,$00,$00,$00,$46
  1306.   IID_IPersistFile:
  1307.   Data.l $0000010b
  1308.   Data.w $0000
  1309.   Data.w $0000
  1310.   Data.b $C0,$00,$00,$00,$00,$00,$00,$46
  1311. EndDataSection
RAW Paste Data