---

pefile.cpp

Go to the documentation of this file.

/*
PeRdr - PE file disassembler
Copyright (C) 1999-2002 Frediano Ziglio
-----

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-----

INFORMATION
  www: https://freddy77.tripod.com/perdr/
  e-mail: freddy77@angelfire.com
*/
#include "global.h"
#ifdef HAVE_HDRSTOP
#pragma hdrstop
#endif

#include <ctime>
#include <cstring>
#include <cctype>
#include <stdexcept>

#include "rva.h"
#include "pefile.hpp"
#include "apicache.h"
#include "utils/compilecheck.hpp"

#define Error(s) { throw std::runtime_error(s); }

static const char *const szDirectoryEntries[] =
{
  "Export",
  "Import",
  "Resource",
  "Exception",
  "Security",
  "Relocation",
  "Debug",
  "Copyright",
  "GlobalPtr",
  "TLS",
  "Load Configuration",
  "Bound Import",
  "IAT",
  "Delayed Imports",
  "COM Runtime",
  "Reserved"
};

PeFile::PeFile(ICFile& _file):
  file(_file),rva(NULL)
{
  file.Seek(0);

        PE_IMAGE_DOS_HEADER dos_hdr;
  RawRead(file,dos_hdr);
  if ( dos_hdr.e_magic != IMAGE_DOS_SIGNATURE )
        Error("File is not a valid DOS EXE");
  file.Seek(dos_hdr.e_lfanew);

  RawRead(file,nt_hdr);
  if ( nt_hdr.Signature != IMAGE_NT_SIGNATURE )
        Error("Invalid NT EXE file");

  if ( nt_hdr.OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC )
        Error("Invalid NT optional header");

  long sections_pos =
      dos_hdr.e_lfanew + FIELD_OFFSET( PE_IMAGE_NT_HEADERS, OptionalHeader ) +
      nt_hdr.FileHeader.SizeOfOptionalHeader;
  file.Seek(sections_pos);

  numSection = nt_hdr.FileHeader.NumberOfSections;
  sections = new PE_IMAGE_SECTION_HEADER[numSection];
  for (unsigned i=0; i<numSection; ++i)
  {
        RawRead(file,sections[i]);
  }

//  new (&GetRVA()) RVAFileTranslator(sections,numSection);
  rva = new RVAFileTranslator(sections,numSection);
}

PeFile::~PeFile()
{
//  GetRVA().RVAFileTranslator::~RVAFileTranslator();
  delete rva;
  delete [] sections;
}

void PeFile::WriteFileHdr(const PE_IMAGE_FILE_HEADER& hdr)
{
#define FIELD "%-30s"
  const char *machine = "Unknown";
  switch (hdr.Machine) {
  default:
  case IMAGE_FILE_MACHINE_UNKNOWN:
    break;
  case IMAGE_FILE_MACHINE_I386:    machine = "I386"; break;
  case IMAGE_FILE_MACHINE_R3000:   machine = "R3000"; break;
  case IMAGE_FILE_MACHINE_R4000:   machine = "R4000"; break;
  case IMAGE_FILE_MACHINE_R10000:  machine = "R10000"; break;
  case IMAGE_FILE_MACHINE_ALPHA:   machine = "Alpha"; break;
  case IMAGE_FILE_MACHINE_POWERPC: machine = "PowerPC"; break;
  }
  printf("File header information\n\n");
  printf(FIELD "%s\n","Machine",machine);
  printf(FIELD "%u\n","Section #",hdr.NumberOfSections);
  printf(FIELD "%08X\n","TimeStamp",hdr.TimeDateStamp);
  printf(FIELD "%08X\n","SymbolTable pointer",hdr.PointerToSymbolTable);
  printf(FIELD "%u\n","Symbol #",hdr.NumberOfSymbols);
  printf(FIELD "%u\n","Optional header size",hdr.SizeOfOptionalHeader);
  uint_fast16_t car = hdr.Characteristics;
  printf("Characteristics %X\n",(int)car);
  if ( car&IMAGE_FILE_RELOCS_STRIPPED )
    printf("  Relocation info stripped from file\n");
  if ( car&IMAGE_FILE_EXECUTABLE_IMAGE )
    printf("  File is executable\n");
  if ( car&IMAGE_FILE_LINE_NUMS_STRIPPED )
    printf("  Line nunbers stripped from file\n");
  if ( car&IMAGE_FILE_LOCAL_SYMS_STRIPPED )
    printf("  Local symbols stripped from file\n");
  if ( car&IMAGE_FILE_BYTES_REVERSED_LO )
    printf("  Bytes of machine word are reversed\n");
  if ( car&IMAGE_FILE_32BIT_MACHINE )
    printf("  32 bit word machine\n");
  if ( car&IMAGE_FILE_DEBUG_STRIPPED )
    printf("  Debugging info stripped from file in .DBG file\n");
  if ( car&IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP )
    printf("  If Image is on removable media, copy and run from the swap file\n");
  if ( car&IMAGE_FILE_NET_RUN_FROM_SWAP )
    printf("  If Image is on Net, copy and run from the swap file\n");
  if ( car&IMAGE_FILE_SYSTEM )
    printf("  System File\n");
  if ( car&IMAGE_FILE_DLL )
    printf("  File is a DLL\n");
  if ( car&IMAGE_FILE_BYTES_REVERSED_HI )
    printf("  Bytes of machine word are reversed\n");
  printf("\n");
#undef FIELD
}

void PeFile::WriteOptionalHdr(const PE_IMAGE_OPTIONAL_HEADER& hdr)
{
#define FIELD "%-30s"
  printf("Optional header information\n\n");
  printf(FIELD "%04X\n","Magic",hdr.Magic);
  printf(FIELD "%d.%d\n","Linker",hdr.MajorLinkerVersion,hdr.MinorLinkerVersion);
  printf(FIELD "%08X\n","Code size",hdr.SizeOfCode);
  printf(FIELD "%08X\n","Initialized data size",hdr.SizeOfInitializedData);
  printf(FIELD "%08X\n","Uninitialized data size",hdr.SizeOfUninitializedData);
  printf(FIELD "%08X\n","Entry point RVA",hdr.AddressOfEntryPoint);
  printf(FIELD "%08X\n","Code base RVA",hdr.BaseOfCode);
  printf(FIELD "%08X\n","Data base RVA",hdr.BaseOfData);

  printf(FIELD "%08X\n","Image base",hdr.ImageBase);
  printf(FIELD "%08X/%08X\n","Section/File align",hdr.SectionAlignment,hdr.FileAlignment);
  printf(FIELD "%d.%d\n","O/S version",hdr.MajorOperatingSystemVersion,hdr.MinorOperatingSystemVersion);
  printf(FIELD "%d.%d\n","Image version",hdr.MajorImageVersion,hdr.MinorImageVersion);
  printf(FIELD "%d.%d\n","Subsystem version",hdr.MajorSubsystemVersion,hdr.MinorSubsystemVersion);
  printf(FIELD "%08X\n","Win32 version",hdr.Win32VersionValue);
  printf(FIELD "%08X\n","Image size",hdr.SizeOfImage);
  printf(FIELD "%08X\n","Headers size",hdr.SizeOfHeaders);
  printf(FIELD "%08X\n","Checksum",hdr.CheckSum);
  const char *subsystem= "Unknown";
  switch (hdr.Subsystem) {
  default:
  case IMAGE_SUBSYSTEM_UNKNOWN:
    break;
  case IMAGE_SUBSYSTEM_NATIVE:       subsystem="Native"; break;
  case IMAGE_SUBSYSTEM_WINDOWS_GUI:  subsystem="Windows GUI"; break;
  case IMAGE_SUBSYSTEM_WINDOWS_CUI:  subsystem="Windows Consolle"; break;
  case IMAGE_SUBSYSTEM_OS2_CUI:      subsystem="OS2 Consolle"; break;
  case IMAGE_SUBSYSTEM_POSIX_CUI:    subsystem="Posix Consolle"; break;
  }
  printf(FIELD "%d (%s)\n","Subsystem",hdr.Subsystem,subsystem);
  printf(FIELD "%08X\n","DLL flags",hdr.DllCharacteristics);
  printf(FIELD "%08X/%08X\n","Stack reserve/commit",hdr.SizeOfStackReserve,hdr.SizeOfStackCommit);
  printf(FIELD "%08X/%08X\n","Heap reserve/commit",hdr.SizeOfHeapReserve,hdr.SizeOfHeapCommit);
  printf(FIELD "%08X\n","Loader flags",hdr.LoaderFlags);
  printf(FIELD "%u\n","RVA #",hdr.NumberOfRvaAndSizes);
  printf("\n%-20s%-10sSize\n","Name","RVA");
  printf("-----------------------------\n");
  for(int i=0; i<16; ++i)
    printf("%-20s%08X  %08X\n",szDirectoryEntries[i],hdr.DataDirectory[i].VirtualAddress,hdr.DataDirectory[i].Size);
  printf("\n");
#undef FIELD
}

void PeFile::WriteSectionHdr(const PE_IMAGE_SECTION_HEADER& hdr)
{
#define FIELD "%-30s"
  printf(FIELD "%-8.8s\n","Name",hdr.Name);
  printf(FIELD "%08X\n","PhysicalAddress",hdr.Misc.PhysicalAddress);
  printf(FIELD "%08X\n","VirtualAddress",hdr.VirtualAddress);
  printf(FIELD "%08X\n","Size of raw data",hdr.SizeOfRawData);
  printf(FIELD "%08X\n","Pointer to raw data",hdr.PointerToRawData);
  printf(FIELD "%08X\n","Pointer to relocations",hdr.PointerToRelocations);
  printf(FIELD "%08X\n","Pointer to linenumbers",hdr.PointerToLinenumbers);
  printf(FIELD "%04X\n","Number of relocations",hdr.NumberOfRelocations);
  printf(FIELD "%04X\n","Number of line numbers",hdr.NumberOfLinenumbers);

  printf("Characteristics\n");
  uint32_t car = hdr.Characteristics;
  if ( car&IMAGE_SCN_CNT_CODE )               printf("  Section contains code\n");
  if ( car&IMAGE_SCN_CNT_INITIALIZED_DATA )   printf("  Section contains initialized data\n");
  if ( car&IMAGE_SCN_CNT_UNINITIALIZED_DATA ) printf("  Section contains uninitialized data\n");
  if ( car&IMAGE_SCN_LNK_INFO )               printf("  Section contains comments or some other type of information\n");
  if ( car&IMAGE_SCN_LNK_REMOVE )             printf("  Section contents will not become part of image\n");
  if ( car&IMAGE_SCN_LNK_COMDAT )             printf("  Section contents comdat\n");

  if ( car&IMAGE_SCN_MEM_FARDATA )            printf("  FarData\n");
  if ( car&IMAGE_SCN_MEM_PURGEABLE )          printf("  Purgeable\n");
  if ( car&IMAGE_SCN_MEM_16BIT )              printf("  16bit\n");
  if ( car&IMAGE_SCN_MEM_LOCKED )             printf("  Locked\n");
  if ( car&IMAGE_SCN_MEM_PRELOAD )            printf("  Preload\n");

  if ( car&IMAGE_SCN_ALIGN_1BYTES )           printf("  Align 1 byte\n");
  if ( car&IMAGE_SCN_ALIGN_2BYTES )           printf("  Align 2 bytes\n");
  if ( car&IMAGE_SCN_ALIGN_4BYTES )           printf("  Align 4 bytes\n");
  if ( car&IMAGE_SCN_ALIGN_8BYTES )           printf("  Align 8 bytes\n");
  if ( car&IMAGE_SCN_ALIGN_16BYTES )          printf("  Align 16 bytes\n");
  if ( car&IMAGE_SCN_ALIGN_32BYTES )          printf("  Align 32 bytes\n");
  if ( car&IMAGE_SCN_ALIGN_64BYTES )          printf("  Align 64 bytes\n");

  if ( car&IMAGE_SCN_LNK_NRELOC_OVFL )        printf("  Section contains extended relocations\n");
  if ( car&IMAGE_SCN_MEM_DISCARDABLE )        printf("  Discardable\n");
  if ( car&IMAGE_SCN_MEM_NOT_CACHED )         printf("  Not cachable\n");
  if ( car&IMAGE_SCN_MEM_NOT_PAGED )          printf("  Not pageable\n");
  if ( car&IMAGE_SCN_MEM_SHARED )             printf("  Shareable\n");
  if ( car&IMAGE_SCN_MEM_EXECUTE )            printf("  Executable\n");
  if ( car&IMAGE_SCN_MEM_READ )               printf("  Readable\n");
  if ( car&IMAGE_SCN_MEM_WRITE )              printf("  Writeable\n");
  printf("\n");
#undef FIELD
}

#ifdef __BORLANDC__
#pragma argsused
#endif
void PeFile::WriteImport(uint32_t address,uint32_t hint,const char* dll_name,const char* func_name,void* param)
{
  if (address == 0)
    printf("\nDLL: %s\n",dll_name);
  else
  {
    printf(" Addr:%08lX ",(long int)address);
    if (func_name==NULL)
                {
                        std::string name;
                        if (ApiCache::GetFullApiName(name,dll_name,hint))
        printf("Ordinal:%u(%04X) (%s)\n",hint,hint,name.c_str());
                        else
        printf("Ordinal:%u(%04X)\n",hint,hint);
                }
    else
        printf("hint:%u(%04X) Name:%s\n",hint,hint,func_name);
  }
}

#ifdef __BORLANDC__
#pragma argsused
#endif
void PeFile::WriteExport(uint32_t address,uint32_t hint,const char* dll_name,const char* func_name,void* param)
{
  if (address == 0)
    printf("\nDLL: %s\n",dll_name);
  else
  {
    printf(" Addr:%08lX ",(long int)address);
    if (func_name==NULL)
        printf("Ordinal:%u(%04X)\n",hint,hint);
    else
        printf("hint:%u(%04X) Name:%s\n",hint,hint,func_name);
  }
}

void PeFile::ParseImport(PImportProc proc,void* param)
{
  const PE_IMAGE_DATA_DIRECTORY& imports =
    GetDataDirectory(IMAGE_DIRECTORY_ENTRY_IMPORT);
  if ( imports.VirtualAddress == 0 || imports.Size == 0 )
    return;

  file.Seek(GetRVA().RVA2FileSafe(imports.VirtualAddress));
  for (;;)
  {
    PE_IMAGE_IMPORT_DESCRIPTOR desc;
    RawRead(file,desc);
    long pos = file.Tell();

    // imports finished
    if (desc.Characteristics == 0 && desc.FirstThunk == 0)
      break;

    uint32_t address = desc.FirstThunk;

    // read DLL name
    file.Seek(GetRVA().RVA2FileSafe(desc.Name));
    char *pDllName = file.ReadString();
    proc(0,0,pDllName,NULL,param);

    // delete ".dll" after name
    int len = strlen(pDllName);
    if (len>=4 && stricmp(pDllName+(len-4),".dll") == 0)
        pDllName[len-4] = '\0';

    // scan import for this DLL
                // hintname is at the same address of FirstThunk ?
                if (desc.OriginalFirstThunk == 0)
                        file.Seek(GetRVA().RVA2FileSafe((uint32_t)desc.FirstThunk));
                else
                        file.Seek(GetRVA().RVA2FileSafe((uint32_t)desc.OriginalFirstThunk));
    for (;;)
    {
      PE_IMAGE_THUNK_DATA thunk;
      RawRead(file,thunk);
      long pos2 = file.Tell();

      // finish with this DLL
      if (thunk.u1.Ordinal == 0)
        break;

      if (IMAGE_SNAP_BY_ORDINAL(thunk.u1.Ordinal))
      {
        // import by ordinal
        proc(address,IMAGE_ORDINAL(thunk.u1.Ordinal),pDllName,NULL,param);
      }
      else
      {
        // import by name
        uint16_t hint;

        // read hint and import name
        file.Seek(GetRVA().RVA2FileSafe((uint32_t)thunk.u1.AddressOfData));
        RawRead(file,hint);
        char *p = file.ReadString();
        proc(address,hint,pDllName,p,param);
        delete [] p;
      }
      address += sizeof(PE_IMAGE_THUNK_DATA);

      file.Seek(pos2);
    }
    file.Seek(pos);
    delete[] pDllName;
  }
}

void PeFile::ParseExport(PExportProc proc,void* param)
{
  // export renamed to export_, in some compiler this is a keyword
  const PE_IMAGE_DATA_DIRECTORY& export_ =
    GetDataDirectory(IMAGE_DIRECTORY_ENTRY_EXPORT);
  if ( export_.VirtualAddress == 0 || export_.Size == 0 )
    return;

  file.Seek(GetRVA().RVA2FileSafe(export_.VirtualAddress));

  PE_IMAGE_EXPORT_DIRECTORY desc;
  RawRead(file,desc);

  // read DLL name
  file.Seek(GetRVA().RVA2FileSafe(desc.Name));
  char *pDllName = file.ReadString();
  proc(0,0,pDllName,NULL,param);

  // delete ".dll" after name
  int len = strlen(pDllName);
  if (len>=4 && stricmp(pDllName+(len-4),".dll") == 0)
        pDllName[len-4] = '\0';

  // scan export for this DLL
  int ordBase = desc.Base;
  long functionPos = GetRVA().RVA2FileSafe(desc.AddressOfFunctions);
  long ordinalPos  = GetRVA().RVA2FileSafe(desc.AddressOfNameOrdinals);
  long namePos     = GetRVA().RVA2FileSafe(desc.AddressOfNames);

  char **names= new char*[desc.NumberOfFunctions];

  // initialize functions
  unsigned n;
  for( n = 0; n<desc.NumberOfFunctions; ++n)
    names[n] = NULL;

  for( n = 0; n<desc.NumberOfNames; ++n)
  {
    uint16_t ordinal;
    char *pName;

    // read name pos
    uint32_t pos;
    file.Seek(namePos);
    RawRead(file,pos);
    namePos = file.Tell();

    // read name
    file.Seek(GetRVA().RVA2FileSafe(pos));
    pName = file.ReadString();

    // read ordinal
    file.Seek(ordinalPos);
    RawRead(file,ordinal);
    ordinalPos = file.Tell();

    // check ordinal
    if (ordinal >= desc.NumberOfFunctions )
      throw std::runtime_error("bad ordinal");

    names[ordinal] = pName;
  }

  file.Seek(functionPos);
  for( n = 0; n<desc.NumberOfFunctions; ++n)
  {
    // read function RVA
    uint32_t funcRVA;
    if (file.Tell() != functionPos)
      file.Seek(functionPos);
    RawRead(file,funcRVA);

    if (funcRVA != 0)
        proc(funcRVA,ordBase + n,pDllName,names[n],param);
    functionPos += 4;

    delete[] names[n];
  }

  delete[] names;
  delete[] pDllName;
}

typedef void (*PRelocationProc)(uint32_t address,unsigned type,void* param);
#ifdef __BORLANDC__
#pragma argsused
#endif
void PeFile::WriteRelocation(uint32_t address,unsigned type,void* param)
{
  printf("%08lX ",(long int)address);
  switch(type)
  {
  case IMAGE_REL_BASED_ABSOLUTE:
        printf("Absolute\n"); break;
  case IMAGE_REL_BASED_HIGH:
        printf("Relative High\n"); break;
  case IMAGE_REL_BASED_LOW:
        printf("Relative Low\n"); break;
  case IMAGE_REL_BASED_HIGHLOW:
        printf("Relative HighLow\n"); break;
  case IMAGE_REL_BASED_HIGHADJ:
        printf("Relative HighAdj\n"); break;
  default:
        printf("Unknown\n"); break;
  }
}

void PeFile::ParseRelocations(PRelocationProc proc,void* param)
{
  const PE_IMAGE_DATA_DIRECTORY& relocation =
    GetDataDirectory(IMAGE_DIRECTORY_ENTRY_BASERELOC);
  if ( relocation.VirtualAddress == 0 || relocation.Size == 0 )
    return;

  file.Seek(GetRVA().RVA2FileSafe(relocation.VirtualAddress));
  if (proc == PeFile::WriteRelocation)
  {
    printf("\nRelocations\n");
    printf("Address  Type\n");
  }
  for (;;)
  {
    PE_IMAGE_BASE_RELOCATION chunk;
    long pos = file.Tell();
    RawRead(file,chunk);
    if (chunk.VirtualAddress == 0)
      break;
    for (int i=(chunk.SizeOfBlock - sizeof(chunk))>>1; i>0; --i)
    {
      uint16_t info;
      RawRead(file,info);
      if (info == 0)
        break;
      proc(chunk.VirtualAddress+(info&0xFFFu),info>>12,param);
    }
    file.Seek(pos+chunk.SizeOfBlock);
  }
  printf("\n");
}

// !!! other file
static void WriteBinary(const ICFile& file,int _len)
{
  _PRG_ASSERT(_len>0);
  unsigned int len = (unsigned int)_len;
  unsigned address = 0;
  const unsigned nCarInRow = 16;
  char buffer[3*nCarInRow+nCarInRow+10];
  for(unsigned n=0;;++n)
  {
    unsigned part = n%nCarInRow;
    if (part==0)
    {
      if (n>=nCarInRow)
      {
        buffer[nCarInRow*3+nCarInRow+1] = '\0';
        printf("%08X %s\n",address+n-nCarInRow,buffer);
        if (n>=len)
          return;
      }
      // inizializza buffer
      memset(buffer,' ',sizeof(buffer));
    }
    if (n<len)
    {
      uint8_t car;
      file.RawRead(&car,1);

      // scrive il carattere in esadecimale e carattere relativo
      sprintf(buffer+part*3,"%02X",car);
      buffer[part*3+2] = part==(nCarInRow/2-1)?'-':' ';
      // !!! settare come opzione carattere ?
      buffer[nCarInRow*3+1+part] = isprint(car)?car:'.';
    }
  }
}


COMPILE_CHECK(error_Only_ASCII_charset_supported,
  ('0' == 0x30 && '9' == 0x39 && 'A' == 0x41 && 'Z' == (0x41+25) && 
   'a' == 0x61 && 'z' == (0x61+25) && ' ' == 32 && '\t' == 9 && '\n' == 10)
  );

// !!! other file
static void out_ws(const unicode_t* s)
{
  for(;*s;++s)
  {
    char c;
    c = char((*s) & 0xff);
    // !!! bad conversion
    if ( (*s) < 256 && isprint(c) )
      printf("%c",c);
    else
      printf("\\x%04x",*s);
  }
}


// if data == 0 this is a directory entry
// first info reference level level directory
// 2nd info (info->highLevel) reference level-1 level and so on
// if data != 0 file point to raw data
// always info != 0
static void WriteResource(ICFile& file,const PeResourceDirectoryData* data,const PeResourceDirectoryInfo* info,unsigned level,void*)
{
  // se siamo all'apice dell'albero
  if (level == 0 && data == NULL)
  {
    printf("Resources\n");
    printf("%*s%-16s%08X\n",level*4,"","Characteristics",info->dir.Characteristics);
    time_t t = (time_t)info->dir.TimeDateStamp;
    printf("%*s%-16s%08X %s",level*4,"","TimeDateStamp",info->dir.TimeDateStamp,ctime(&t));
    printf("%*s%-16s%i:%i\n",level*4,"","Version",info->dir.MajorVersion,info->dir.MinorVersion);
  }
  else
  {
  // se c'e' un livello superiore stampa id o nome
  // se dati bisogna prendere il livello corrente
  const PeResourceId* p = data?(const PeResourceId*)data:(const PeResourceId*)info;
  if (p)
  {
    printf("%*s",(level)*4,"");
    switch(level-1)
    {
    case 0:
      printf("Type ");
      switch(p->id)
      {
      case 1: printf("cursor"); break;
      case 2: printf("bitmap"); break;
      case 3: printf("icon"); break;
      case 4: printf("menu"); break;
      case 5: printf("dialog"); break;
      case 6: printf("string table"); break;
      case 7: printf("font directory"); break;
      case 8: printf("font"); break;
      case 9: printf("accelerators"); break;
      case 10: printf("unformatted resource data"); break;
      case 11: printf("message table"); break;
      case 12: printf("group cursor"); break;
      case 14: printf("group icon"); break;
      case 16: printf("version information"); break;
      case 17: printf("dialog include"); break;
      case 19: printf("plug & play"); break;
      case 20: printf("vxd"); break;
      case 21: printf("animate cursor"); break;
      case 22: printf("animate icon"); break;
      case 23: printf("html"); break;
      default: printf("unknown"); break;
      }
      if (p->name)
      {
        printf(" (");
        out_ws(p->name);
        printf(")\n");
      }
      else
        printf(" (%i)\n",p->id);
      break;
    case 1:
      if (p->name)
      {
        printf("ID ");
        out_ws(p->name);
        printf("\n");
      }
      else
        printf("ID %i\n",p->id);
      break;
    case 2:
      if (p->name)
      {
        printf("LangID ");
        out_ws(p->name);
        printf("\n");
      }
      else
        printf("LangID %i\n",p->id);
      break;
    default:
      if (p->name)
      {
        printf("Name ");
        out_ws(p->name);
        printf("\n");
      }
      else
        printf("Name %08X\n",p->id);
      break;
    }
  }
  }

  // for directory write available entries
  if (data == NULL)
    printf("%*s%-16s%i named %i id\n",level*4,"","Entryes",info->dir.NumberOfNamedEntries,info->dir.NumberOfIdEntries);

  // for data write data information
  if (data)
  {
      printf("%*s%-16s%08X\n",(level)*4,"","OffsetToData",data->data.OffsetToData);
      printf("%*s%-16s%08X\n",(level)*4,"","Size",data->data.Size);
      printf("%*s%-16s%08X\n",(level)*4,"","CodePage",data->data.CodePage);
      printf("%*s%-16s%08X\n",(level)*4,"","Reserved",data->data.Reserved);
      // !!! use best method, save file ??
      WriteBinary(file,data->data.Size);
  }
}

static void ParseResourceDirectory(const RVAFileTranslator& rva,uint32_t start,PeResourceDirectoryInfo *info,unsigned level,ICFile& file,PeFile::PResourceProc proc,void* param)
{
  // read raw directory info
  RawRead(file,info->dir);

  proc(file,NULL,info,level,param);

  int i = info->dir.NumberOfNamedEntries + info->dir.NumberOfIdEntries;
  for(;i>0;--i)
  {
    PE_IMAGE_RESOURCE_DIRECTORY_ENTRY entry;
    RawRead(file,entry);
    long pos = file.Tell();
    // finish (ID, Type, Language)
    unicode_t *pName = NULL;
    if ( RESOURCE_ENTRY_ISSTRING(entry) )
    {

      file.Seek(start+RESOURCE_ENTRY_NAME_OFFSET(entry));
      pName = (unicode_t*)file.ReadStringFlag(
        ICFile::strUcs2|ICFile::strLen16);
    }

    if ( RESOURCE_ENTRY_ISDIRECTORY(entry) )
    {
      file.Seek(start+RESOURCE_ENTRY_DATA_OFFSET(entry) );

      // init directory
      PeResourceDirectoryInfo _info;
      _info.name = pName;
      _info.id   = RESOURCE_ENTRY_GETID(entry);
      _info.highLevel = info;

      ParseResourceDirectory(rva,start,&_info,level+1,file,proc,param);
    }
    else
    {
      file.Seek(start+entry.u2.OffsetToData);

      // init data
      PeResourceDirectoryData data;
      RawRead(file,data.data);
      data.id = RESOURCE_ENTRY_GETID(entry);
      data.name = pName;

      file.Seek(rva.RVA2FileSafe(data.data.OffsetToData));
      proc(file,&data,info,level+1,param);
    }
    delete [] pName;

    file.Seek(pos);
  }
}

void PeFile::ParseResource(PResourceProc proc,void* param)
{
  const PE_IMAGE_DATA_DIRECTORY& resource =
    GetDataDirectory(IMAGE_DIRECTORY_ENTRY_RESOURCE);
  if ( resource.VirtualAddress == 0 || resource.Size == 0 )
    return;

  uint32_t start = GetRVA().RVA2FileSafe(resource.VirtualAddress);
  file.Seek(start);

  // init directory info (root)
  PeResourceDirectoryInfo info;
  info.name = NULL;
  info.id   = 0;
  info.highLevel = NULL;

  ParseResourceDirectory(GetRVA(),start,&info,0,file,proc,param);
}

void PeFile::WriteResource()
{
  ParseResource(::WriteResource,NULL);
}

---