Skip to content
Portable Executable reader / writer for Delphi
Pascal C++ SourcePawn
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
Examples
Test
bin/examples
AllUnits.dpr
AllUnits.dproj
LICENSE
NullStream.pas
PE.Build.Common.pas
PE.Build.Export.pas
PE.Build.Import.pas
PE.Build.Relocs.pas
PE.Build.Resource.pas
PE.Build.pas
PE.COFF.Types.pas
PE.COFF.pas
PE.Common.pas
PE.DataDirectories.pas
PE.ExecutableLoader.pas
PE.ExportSym.pas
PE.FileHeaderToStr.pas
PE.Headers.pas
PE.ID.pas
PE.Image.Defaults.pas
PE.Image.Saving.pas
PE.Image.pas
PE.Image.x86.pas
PE.Imports.Func.pas
PE.Imports.Lib.pas
PE.Imports.pas
PE.MemoryStream.pas
PE.Msg.pas
PE.Parser.Export.pas
PE.Parser.Headers.pas
PE.Parser.Import.pas
PE.Parser.ImportDelayed.pas
PE.Parser.PData.pas
PE.Parser.Relocs.pas
PE.Parser.Resources.pas
PE.Parser.TLS.pas
PE.ParserCallbacks.pas
PE.ProcessModuleStream.pas
PE.RTTI.pas
PE.Resources.Extract.pas
PE.Resources.VersionInfo.pas
PE.Resources.Windows.Bitmap.pas
PE.Resources.Windows.Strings.pas
PE.Resources.Windows.pas
PE.Resources.pas
PE.Search.pas
PE.Section.pas
PE.Sections.pas
PE.TLS.pas
PE.Types.DOSHeader.pas
PE.Types.Directories.pas
PE.Types.Export.pas
PE.Types.FileHeader.pas
PE.Types.Imports.pas
PE.Types.ImportsDelayed.pas
PE.Types.NTHeaders.pas
PE.Types.OptionalHeader.pas
PE.Types.Relocations.inc
PE.Types.Relocations.pas
PE.Types.Resources.pas
PE.Types.Sections.inc
PE.Types.Sections.pas
PE.Types.TLS.pas
PE.Types.pas
PE.Utils.pas
README.md
VerRsrc.inc
WinHelper.pas
gmap.pas
grbtree.pas

README.md

pe-image-for-delphi

This is Delphi library to work with Portable Executable Image files. The main purpose is to make parsing image structures of 32/64 bit image easy. Now it can parse most used things, like: sections, imports, exports, resources and tls.

Also it can write image, but that was not primary goal.

ToDo:

  • There must be introduced sparsed/paged virtual memory concept (just like Windows does) Currently all section data is loaded into memory. Some virus samples tested can crash loading because of using too big virtual address range. With normal compiler generated images you won't have such problem.
You can’t perform that action at this time.