易语言PEID的查壳工具源码

系统结构:查看导入表,查看基本信息,取父级文本,计算偏差,编辑框_文件,查看区段,查看详情,查看导出表,查看TLS表,查看调试表,RtlMoveMemory_IMAGE_DOS_HEADER,RtlMoveMemory_IMAGE_NT_HEADERS32,RtlMoveMemory_IMAGE_IMPORT_DESCRIPTOR,RtlMoveMemory_IMAGE_EXPORT_DIRECTORY,RtlMoveMemory_IMAGE_TLS_DIRECTORY32,RtlMoveMemory_IMAGE_DEBUG_DIRECTORY,RtlMoveMemory_IMAGE_SECTION_HEADER,

======窗口_导入表查看器
           |  |
           |  |------ _窗口_导入表查看器_尺寸被改变
           |  |
           |  |------ 查看导入表
           |  |
           |  |------ _超级列表框_模块列表_当前表项被改变
           |  |
           |  |
======窗口_启动窗口
           |  |
           |  |------ _按钮_打开_被单击
           |  |
           |  |------ 查看基本信息
           |  |
           |  |------ _按钮_区段查看_被单击
           |  |
           |  |------ 取父级文本
           |  |
           |  |------ _按钮_PE详情_被单击
           |  |
           |  |------ 计算偏差
           |  |
           |  |------ __启动窗口_创建完毕
           |  |
           |  |------ _标签2_反馈事件
           |  |
           |  |------ _按钮__被单击
           |  |
           |  |------ _按钮1_被单击
           |  |
           |  |------ 编辑框_文件
           |  |
           |  |------ _拖放对象1_得到文件
           |  |
           |  |------ _按钮2_被单击
           |  |
           |  |
======窗口_区段查看器
           |  |
           |  |------ _窗口_区段查看器_尺寸被改变
           |  |
           |  |------ 查看区段
           |  |
           |  |
======窗口_详情
           |  |
           |  |------ 查看详情
           |  |
           |  |------ _按钮_导出表_被单击
           |  |
           |  |------ _按钮_导入表_被单击
           |  |
           |  |------ _按钮_资源_被单击
           |  |
           |  |------ _按钮_tls_被单击
           |  |
           |  |------ _按钮_调试_被单击
           |  |
           |  |
======窗口_导出表查看器
           |  |
           |  |------ 查看导出表
           |  |
           |  |
======窗口_tls表查看器
           |  |
           |  |------ 查看TLS表
           |  |
           |  |
======窗口_调试表查看器
           |  |
           |  |------ 查看调试表
           |  |
           |  |
======窗口程序集1
           |  |
           |  |
======调用的Dll
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_DOS_HEADER
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_NT_HEADERS32
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_IMPORT_DESCRIPTOR
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_EXPORT_DIRECTORY
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_TLS_DIRECTORY32
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_DEBUG_DIRECTORY
           |  |
           |  |---[dll]------   RtlMoveMemory_IMAGE_SECTION_HEADER

调用的DLL命令:

.DLL命令 RtlMoveMemory_IMAGE_DOS_HEADER, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_DOS_HEADER
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_NT_HEADERS32, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_NT_HEADERS32
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_IMPORT_DESCRIPTOR, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_IMPORT_DESCRIPTOR
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_EXPORT_DIRECTORY, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_EXPORT_DIRECTORY
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_TLS_DIRECTORY32, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_TLS_DIRECTORY32
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_DEBUG_DIRECTORY, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_DEBUG_DIRECTORY
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 RtlMoveMemory_IMAGE_SECTION_HEADER, , , "RtlMoveMemory"
    .参数 Destination, IMAGE_SECTION_HEADER, 数组
    .参数 Source, 整数型
    .参数 Length, 整数型