home *** CD-ROM | disk | FTP | other *** search
- unit Unit1;
-
- interface
-
- uses
- Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
- Buttons, StdCtrls, TCSComp;
-
- type
- PIMAGE_DOS_HEADER = ^IMAGE_DOS_HEADER;
- IMAGE_DOS_HEADER = packed record { DOS .EXE header }
- e_magic : WORD; { Magic number }
- e_cblp : WORD; { Bytes on last page of file }
- e_cp : WORD; { Pages in file }
- e_crlc : WORD; { Relocations }
- e_cparhdr : WORD; { Size of header in paragraphs }
- e_minalloc : WORD; { Minimum extra paragraphs needed }
- e_maxalloc : WORD; { Maximum extra paragraphs needed }
- e_ss : WORD; { Initial (relative) SS value }
- e_sp : WORD; { Initial SP value }
- e_csum : WORD; { Checksum }
- e_ip : WORD; { Initial IP value }
- e_cs : WORD; { Initial (relative) CS value }
- e_lfarlc : WORD; { File address of relocation table }
- e_ovno : WORD; { Overlay number }
- e_res : packed array [0..3] of WORD; { Reserved words }
- e_oemid : WORD; { OEM identifier (for e_oeminfo) }
- e_oeminfo : WORD; { OEM information; e_oemid specific }
- e_res2 : packed array [0..9] of WORD; { Reserved words }
- e_lfanew : Longint; { File address of new exe header }
- end;
-
- PIMAGE_OPTIONAL_HEADER = ^IMAGE_OPTIONAL_HEADER;
- IMAGE_OPTIONAL_HEADER = packed record
- { Standard fields. }
- Magic : WORD;
- MajorLinkerVersion : Byte;
- MinorLinkerVersion : Byte;
- SizeOfCode : DWORD;
- SizeOfInitializedData : DWORD;
- SizeOfUninitializedData : DWORD;
- AddressOfEntryPoint : DWORD;
- BaseOfCode : DWORD;
- BaseOfData : DWORD;
- { NT additional fields. }
- ImageBase : DWORD;
- SectionAlignment : DWORD;
- FileAlignment : DWORD;
- MajorOperatingSystemVersion : WORD;
- MinorOperatingSystemVersion : WORD;
- MajorImageVersion : WORD;
- MinorImageVersion : WORD;
- MajorSubsystemVersion : WORD;
- MinorSubsystemVersion : WORD;
- Reserved1 : DWORD;
- SizeOfImage : DWORD;
- SizeOfHeaders : DWORD;
- CheckSum : DWORD; // File checksum tested with MapFileAndCheckSum
- Subsystem : WORD;
- DllCharacteristics : WORD;
- SizeOfStackReserve : DWORD;
- SizeOfStackCommit : DWORD;
- SizeOfHeapReserve : DWORD;
- SizeOfHeapCommit : DWORD;
- LoaderFlags : DWORD;
- NumberOfRvaAndSizes : DWORD;
- // DataDirectory : packed array [0..IMAGE_NUMBEROF_DIRECTORY_ENTRIES-1] of IMAGE_DATA_DIRECTORY;
- end;
-
- TForm1 = class(TForm)
- Label1: TLabel;
- Label2: TLabel;
- Button1: TButton;
- Edit1: TEdit;
- SpeedButton1: TSpeedButton;
- OpenDialog1: TOpenDialog;
- Button2: TButton;
- FileCheckSumComp1: TFileCheckSumComp;
- Edit2: TEdit;
- procedure SpeedButton1Click(Sender: TObject);
- procedure Button1Click(Sender: TObject);
- procedure Button2Click(Sender: TObject);
- private
- { Private declarations }
- public
- { Public declarations }
- end;
-
- var
- Form1: TForm1;
-
- implementation
-
- {$R *.DFM}
- // Key function of the program
- function MapFileAndCheckSum(Filename: PChar; // File to get checksum
- var HeaderSum, // Checksum read from PE file header. For Delphi compiled programs it is always 0
- CheckSum: DWORD // Calculated checksum
- ): DWORD; // 0 if success
- stdcall; external 'Imagehlp.dll' name 'MapFileAndCheckSumA';
-
- procedure TForm1.SpeedButton1Click(Sender: TObject);
- begin
- if OpenDialog1.Execute then
- Edit1.text:=Opendialog1.FileName;
- end;
-
- procedure TForm1.Button1Click(Sender: TObject);
- var a,b:DWord;
- begin
- if MapFileAndCheckSum(PChar(Edit1.Text),a,b)=0 then begin
- Label1.Caption:='Found: '+Inttohex(a,8);
- Edit2.Text:=Inttohex(b,8);
- end
- end;
-
- procedure TForm1.Button2Click(Sender: TObject);
- var f:file;
- Dos:Image_Dos_Header;
- NT:Image_Optional_Header;
- c:char;
- a,b:DWord;
- begin
- if MessageDlg('Do you have file backup copy?'+#13+#10+ 'This operation can destroy original file!',
- mtWarning, [mbNo, mbYes], 0) = mrNo then Exit;
- try
- assignfile(f,Edit1.text);
- Reset(f,1);
- BlockRead(f,Dos,sizeof(Dos));
- if Dos.e_lfanew<sizeof(dos) then exit;
- Seek(f,Dos.e_lfanew); // Go to the Win32 program header
- // Check the signature
- Blockread(f,c,1);
- if c<>'P' then begin
- Showmessage('Not a program file!');
- exit;
- end;
- Blockread(f,c,1);
- if c<>'E' then begin
- Showmessage('Not a program file!');
- exit;
- end;
- Blockread(f,c,1);
- if c<>#0 then begin
- Showmessage('Not a program file!');
- exit;
- end;
- Blockread(f,c,1);
- if c<>#0 then begin
- Showmessage('Not a program file!');
- exit;
- end;
- Seek(f,Dos.e_lfanew+24); // Go to the optional header
- BlockRead(f,NT,sizeof(NT));
- if NT.CheckSum>0 then // Do not change if file has checksum
- Showmessage('Already has checksum '+inttohex(NT.CheckSum,8)) // Display it
- else
- if MapFileAndCheckSum(PChar(Edit1.Text),a,b)=0 then begin
- NT.CheckSum:=b; // Set the checksum to the calculated one
- Seek(f,Dos.e_lfanew+24);
- BlockWrite(f,NT,sizeof(NT)); // Save changed header
- end;
- finally
- Closefile(f);
- end;
- end;
-
- end.
-