1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11: 12: 13: 14: 15: 16: 17: 18: 19: 20: 21: 22: 23: 24: 25: 26: 27: 28: 29: 30: 31: 32: 33: 34: 35: 36: 37: 38: 39: 40: 41: 42: 43: 44: 45: 46: 47: 48: 49: 50: 51: 52: 53: 54:
| procedure DumpOptionalHeader(const h: IMAGE_OPTIONAL_HEADER; Lines: TStrings); begin Lines.Add('Dump of PE optional file header'); Lines.Add(Format('Magic: %d', [h.Magic])); case h.Magic of $107: Lines.Add(' ROM image'); $10b: Lines.Add(' executable image'); else Lines.Add(' unknown image type'); end; { If } Lines.Add(Format('MajorLinkerVersion: %d', [h.MajorLinkerVersion])); Lines.Add(Format('MinorLinkerVersion: %d', [h.MinorLinkerVersion])); Lines.Add(Format('SizeOfCode: %d', [h.SizeOfCode])); Lines.Add(Format('SizeOfInitializedData: %d', [h.SizeOfInitializedData])); Lines.Add(Format('SizeOfUninitializedData: %d', [h.SizeOfUninitializedData])); Lines.Add(Format('AddressOfEntryPoint: %d', [h.AddressOfEntryPoint])); Lines.Add(Format('BaseOfCode: %d', [h.BaseOfCode])); Lines.Add(Format('BaseOfData: %d', [h.BaseOfData])); Lines.Add(Format('ImageBase: %d', [h.ImageBase])); Lines.Add(Format('SectionAlignment: %d', [h.SectionAlignment])); Lines.Add(Format('FileAlignment: %d', [h.FileAlignment])); Lines.Add(Format('MajorOperatingSystemVersion: %d', [h.MajorOperatingSystemVersion])); Lines.Add(Format('MinorOperatingSystemVersion: %d', [h.MinorOperatingSystemVersion])); Lines.Add(Format('MajorImageVersion: %d', [h.MajorImageVersion])); Lines.Add(Format('MinorImageVersion: %d', [h.MinorImageVersion])); Lines.Add(Format('MajorSubsystemVersion: %d', [h.MajorSubsystemVersion])); Lines.Add(Format('MinorSubsystemVersion: %d', [h.MinorSubsystemVersion])); Lines.Add(Format('Win32VersionValue: %d', [h.Win32VersionValue])); Lines.Add(Format('SizeOfImage: %d', [h.SizeOfImage])); Lines.Add(Format('SizeOfHeaders: %d', [h.SizeOfHeaders])); Lines.Add(Format('CheckSum: %d', [h.CheckSum])); Lines.Add(Format('Subsystem: %d', [h.Subsystem])); case h.Subsystem of IMAGE_SUBSYSTEM_NATIVE: Lines.Add(' Image doesn''t require a subsystem. '); IMAGE_SUBSYSTEM_WINDOWS_GUI: Lines.Add(' Image runs in the Windows GUI subsystem. '); IMAGE_SUBSYSTEM_WINDOWS_CUI: Lines.Add(' Image runs in the Windows character subsystem. '); IMAGE_SUBSYSTEM_OS2_CUI: Lines.Add(' image runs in the OS/2 character subsystem. '); IMAGE_SUBSYSTEM_POSIX_CUI: Lines.Add(' image run in the Posix character subsystem. '); else Lines.Add(' unknown subsystem') end; { Case } Lines.Add(Format('DllCharacteristics: %d', [h.DllCharacteristics])); Lines.Add(Format('SizeOfStackReserve: %d', [h.SizeOfStackReserve])); Lines.Add(Format('SizeOfStackCommit: %d', [h.SizeOfStackCommit])); Lines.Add(Format('SizeOfHeapReserve: %d', [h.SizeOfHeapReserve])); Lines.Add(Format('SizeOfHeapCommit: %d', [h.SizeOfHeapCommit])); Lines.Add(Format('LoaderFlags: %d', [h.LoaderFlags])); Lines.Add(Format('NumberOfRvaAndSizes: %d', [h.NumberOfRvaAndSizes])); end; |