//PE文件分析工具
//判断文件是否为标准PE文件

/************************************
Author		: ECranesoft Lab
Time		: March 16, 2010
Version		: V1.0.0.01
Description : Analysis tool for PE file
************************************/ 

import win.ui; 
import win.ui.menu
import fsys.dlg
/*DSG{{*/
var winform = win.form( bottom=219;text="";right=474 )
winform.add( 
btnbuild={ bottom=157;text="button";left=239;top=131;z=2;right=329;cls="button" };
progress={ bottom=183;max=100;text="progress";left=69;top=163;z=4;right=421;min=0;edge=1;cls="progress" };
static={ right=380;bottom=84;text="static";left=45;top=65;z=3;transparent=1;cls="static" };
btndlg={ bottom=46;text="button";left=319;top=20;z=0;right=409;cls="button" };
editpath={ bottom=46;right=313;left=31;multiline=1;top=19;z=1;text="edit";edge=1;cls="edit" }
)
/*}}*/

winform.btnbuild.oncommand = function(hwnd,event){
	//win.msgbox( winform.btnbuild.text ); 
	var file = io.open( assert( winform.editpath.text ),"r" );
	
	if( winform.editpath.text == "" ){
		winform.static.text = "错误: 请输入或者选择要分析的文件!";
		winform.redraw();
		return ; 
	}
	
	//效果
	winform.static.text = false;
	winform.redraw();
    winform.progress.visible = true;//显示进度条
	for(i=1;10;1){ //循还从1到10
	    winform.progress.pos += 10 //增加进度
	    win.delay(100)
	}
	winform.progress.pos = 0
	winform.progress.visible = false;//隐藏进度条
	winform.static.text = true;
	winform.redraw();
	
	
	var doshead = file.read(2);
	if(doshead != '\x4d\x5a'){
		winform.static.text = "分析结果：该文件不是标准PE文件!";
		winform.redraw();
	   return;
	}
	   
	file.seek("set",60);
	var lfanew = file.read(4);
	var e_lfanew = raw.convert(lfanew,{INT int;} );
	if(!e_lfanew){
	   winform.static.text = "分析结果：该文件不是标准PE文件";
	   winform.redraw();
	   return;
	}
	file.seek("set",e_lfanew.int) 
	ntheader_pos = file.read(4);
	if(!ntheader_pos){
		winform.static.text = "分析结果：该文件不是标准PE文件";
		winform.redraw();
	    return;
	 }
	 
	ntheader = raw.convert(ntheader_pos,{INT int;} );
	//io.print( string.format("%x", ntheader.int)  )
	
	file.seek("set",e_lfanew.int + 24 + 68 ) 
	pe_subsystem = file.read(2);
	pe_subsystem = raw.convert(pe_subsystem,{WORD int;} );
	select(pe_subsystem.int) {
		case 2 
		{
			winform.static.text = "分析结果：该文件为窗口程序!";
			winform.redraw();
		}
		case 3
		{
			winform.static.text = "分析结果：该文件为控制台程序!";
			winform.redraw();
		} 
		
	} 
}
	
winform.btndlg.oncommand = function(hwnd,event){
	//win.msgbox( winform.btndlg.text );
	var str  = fsys.dlg.open()
	if( str)
		winform.editpath.text = str;
}//end callback



winform.show(true) 
win.loopMessage( winform );



