BorlandTalk.com

Guest

Hello everyone,

I'm using the ExeImage.pas from the Delphi resxplor demo. I've the
following case where:

1. Use ExeImage to load the demo.exe;
2. Find the DVCLAL resourceitem from the ExeImage.
3. Read the offset from DVCLAL resourceitem.
4. Use FileStream to load the demo.exe;
5. Locate the position of DVCLAL in FileStream based on the
resourceitem.offset and read the contents.
6. Compare the content with DVCLAL resourceitem.rawdata.

The following is my codes.

function GetDVCLAL(const AResourceItem: TResourceItem): TResourceItem;
var i: Integer;
begin
Result := nil;
if not AResourceItem.IsList then begin
if AResourceItem.Name = 'DVCLAL' then
Result := AResourceItem;
end else begin
for i := 0 to AResourceItem.List.Count - 1 do begin
Result := GetDVCLAL(AResourceItem.Items[i]);
if Assigned(Result) then Break;
end;
end;
end;

procedure TForm2.btnOpenClick(Sender: TObject);
var E: TExeImage;
F: TFileStream;
S, S2: String;
i, vOffset, vSize: Integer;
begin
E := TExeImage.CreateImage(nil, 'c:\project\output.d10\mars
\demo.exe');
try
for i := 0 to E.Resources.Count - 1 do begin
O := GetDVCLAL(E.Resources[i]);
if Assigned(O) then begin
vOffSet := O.OffSet; // Offset is 143030
vSize := O.Size;
S1 := PChar(O.RawData);
end;
finally
E.Free;
end;

F := TFileStream.Create('c:\project\output.d10\mars\demo.exe');
try
SetLength(S, vSize);
F.Position := vOffSet;
F.Read(S[1], vSize);

if S = S1 then ShowMessage('Match !');
finally
F.Free;
end;
end;

I've found that the offset that I read from resourceitem is not equals
to the exact positions (e.g: $0013F630) in the FileStream. Can anyone
here please give me some advices on how to calculate the position in
TFileStream based on the Offset that I've get from the TResourceItem ?

Please give me some advices.

Thanks for spending time to read my message.

Regards: Tonny