Skip to content

Commit d42f8d8

Browse files
dmexdmex
committed
peview: Add raw sections, Add raw prodid hash, Add unused header bytes, Disable PE directory rva highlighting
1 parent 63ebd7b commit d42f8d8

File tree

7 files changed

+118
-116
lines changed

7 files changed

+118
-116
lines changed

‎tools/peview/pedirprp.c

Lines changed: 52 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -22,37 +22,37 @@
2222

2323
#include <peview.h>
2424

25-
BOOLEAN PvpPeCheckImageDataEntryAddress(
26-
_In_ ULONG Index,
27-
_In_ ULONG StartRva,
28-
_In_ ULONG EndRva
29-
)
30-
{
31-
PIMAGE_DATA_DIRECTORY directory;
32-
33-
for (ULONG i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
34-
{
35-
if (i == Index)
36-
continue;
37-
38-
if (NT_SUCCESS(PhGetMappedImageDataEntry(&PvMappedImage, i, &directory)))
39-
{
40-
if ((StartRva >= directory->VirtualAddress) &&
41-
(StartRva < directory->VirtualAddress + directory->Size))
42-
{
43-
return TRUE;
44-
}
45-
46-
if ((EndRva >= directory->VirtualAddress) &&
47-
(EndRva < directory->VirtualAddress + directory->Size))
48-
{
49-
return TRUE;
50-
}
51-
}
52-
}
53-
54-
return FALSE;
55-
}
25+
//BOOLEAN PvpPeCheckImageDataEntryAddress(
26+
// _In_ ULONG Index,
27+
// _In_ ULONG StartRva,
28+
// _In_ ULONG EndRva
29+
// )
30+
//{
31+
// PIMAGE_DATA_DIRECTORY directory;
32+
//
33+
// for (ULONG i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
34+
// {
35+
// if (i == Index)
36+
// continue;
37+
//
38+
// if (NT_SUCCESS(PhGetMappedImageDataEntry(&PvMappedImage, i, &directory)))
39+
// {
40+
// if ((StartRva >= directory->VirtualAddress) &&
41+
// (StartRva < directory->VirtualAddress + directory->Size))
42+
// {
43+
// return TRUE;
44+
// }
45+
//
46+
// if ((EndRva >= directory->VirtualAddress) &&
47+
// (EndRva < directory->VirtualAddress + directory->Size))
48+
// {
49+
// return TRUE;
50+
// }
51+
// }
52+
// }
53+
//
54+
// return FALSE;
55+
//}
5656

5757
VOID PvpPeEnumerateImageDataDirectory(
5858
_In_ HWND ListViewHandle,
@@ -63,7 +63,7 @@ VOID PvpPeEnumerateImageDataDirectory(
6363
INT lvItemIndex;
6464
ULONG directoryAddress = 0;
6565
ULONG directorySize = 0;
66-
BOOLEAN directoryOverlay = FALSE;
66+
//BOOLEAN directoryOverlay = FALSE;
6767
PIMAGE_DATA_DIRECTORY directory;
6868
PIMAGE_SECTION_HEADER directorySection = NULL;
6969
WCHAR value[PH_INT64_STR_LEN_1];
@@ -85,18 +85,18 @@ VOID PvpPeEnumerateImageDataDirectory(
8585
directorySection = PhMappedImageRvaToSection(&PvMappedImage, directoryAddress);
8686
}
8787

88-
if (directoryAddress && directorySize)
89-
{
90-
directoryOverlay = PvpPeCheckImageDataEntryAddress(
91-
Index,
92-
directoryAddress,
93-
PtrToUlong(PTR_ADD_OFFSET(directoryAddress, directorySize))
94-
);
95-
}
88+
//if (directoryAddress && directorySize)
89+
//{
90+
// directoryOverlay = PvpPeCheckImageDataEntryAddress(
91+
// Index,
92+
// directoryAddress,
93+
// PtrToUlong(PTR_ADD_OFFSET(directoryAddress, directorySize))
94+
// );
95+
//}
9696
}
9797

9898
PhPrintUInt32(value, Index + 1);
99-
lvItemIndex = PhAddListViewItem(ListViewHandle, MAXINT, value, (PVOID)directoryOverlay);
99+
lvItemIndex = PhAddListViewItem(ListViewHandle, MAXINT, value, NULL);
100100
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 1, Name);
101101

102102
if (directoryAddress)
@@ -170,16 +170,16 @@ typedef struct _PVP_PE_DIRECTORY_CONTEXT
170170
HIMAGELIST ListViewImageList;
171171
} PVP_PE_DIRECTORY_CONTEXT, *PPVP_PE_DIRECTORY_CONTEXT;
172172

173-
COLORREF NTAPI PvPeSectionColorFunction(
174-
_In_ INT Index,
175-
_In_ PVOID Param,
176-
_In_opt_ PVOID Context
177-
)
178-
{
179-
if ((BOOLEAN)Param)
180-
return RGB(0xf0, 0xa0, 0xa0);
181-
return RGB(0xff, 0xff, 0xff);
182-
}
173+
//COLORREF NTAPI PvPeSectionColorFunction(
174+
// _In_ INT Index,
175+
// _In_ PVOID Param,
176+
// _In_opt_ PVOID Context
177+
// )
178+
//{
179+
// if ((BOOLEAN)Param)
180+
// return RGB(0xf0, 0xa0, 0xa0);
181+
// return RGB(0xff, 0xff, 0xff);
182+
//}
183183

184184
INT_PTR CALLBACK PvpPeDirectoryDlgProc(
185185
_In_ HWND hwndDlg,
@@ -221,7 +221,7 @@ INT_PTR CALLBACK PvpPeDirectoryDlgProc(
221221
PhAddListViewColumn(context->ListViewHandle, 5, 5, 5, LVCFMT_LEFT, 100, L"Section");
222222
PhAddListViewColumn(context->ListViewHandle, 6, 6, 6, LVCFMT_LEFT, 100, L"Hash");
223223
PhSetExtendedListView(context->ListViewHandle);
224-
ExtendedListView_SetItemColorFunction(context->ListViewHandle, PvPeSectionColorFunction);
224+
//ExtendedListView_SetItemColorFunction(context->ListViewHandle, PvPeSectionColorFunction);
225225
PhLoadListViewColumnsFromSetting(L"ImageDirectoryListViewColumns", context->ListViewHandle);
226226

227227
if (context->ListViewImageList = ImageList_Create(2, 20, ILC_MASK | ILC_COLOR, 1, 1))

‎tools/peview/peprp.c

Lines changed: 37 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,8 @@ typedef enum _PVP_IMAGE_GENERAL_INDEX
5252
PVP_IMAGE_GENERAL_INDEX_IMAGESIZE,
5353
PVP_IMAGE_GENERAL_INDEX_ENTRYPOINT,
5454
PVP_IMAGE_GENERAL_INDEX_CHECKSUM,
55-
PVP_IMAGE_GENERAL_INDEX_CHECKSUMIAT,
55+
//PVP_IMAGE_GENERAL_INDEX_CHECKSUMIAT,
56+
PVP_IMAGE_GENERAL_INDEX_HEADERSPARE,
5657
PVP_IMAGE_GENERAL_INDEX_SUBSYSTEM,
5758
PVP_IMAGE_GENERAL_INDEX_SUBSYSTEMVERSION,
5859
PVP_IMAGE_GENERAL_INDEX_CHARACTERISTICS,
@@ -477,38 +478,11 @@ static NTSTATUS CheckSumImageThreadStart(
477478
)
478479
{
479480
HWND windowHandle = Parameter;
480-
PPH_STRING importHash = NULL;
481481
ULONG checkSum;
482-
HANDLE fileHandle;
483482

484483
checkSum = PhCheckSumMappedImage(&PvMappedImage);
485484

486-
if (NT_SUCCESS(PhCreateFileWin32(
487-
&fileHandle,
488-
PhGetString(PvFileName),
489-
FILE_READ_DATA | SYNCHRONIZE,
490-
FILE_ATTRIBUTE_NORMAL,
491-
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
492-
FILE_OPEN,
493-
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT
494-
)))
495-
{
496-
BYTE importTableMd5Hash[16];
497-
498-
if (NT_SUCCESS(RtlComputeImportTableHash(fileHandle, importTableMd5Hash, RTL_IMPORT_TABLE_HASH_REVISION)))
499-
{
500-
importHash = PhBufferToHexString(importTableMd5Hash, 16);
501-
}
502-
503-
NtClose(fileHandle);
504-
}
505-
506-
PostMessage(
507-
windowHandle,
508-
PVM_CHECKSUM_DONE,
509-
checkSum,
510-
(LPARAM)importHash
511-
);
485+
PostMessage(windowHandle, PVM_CHECKSUM_DONE, checkSum, 0);
512486

513487
return STATUS_SUCCESS;
514488
}
@@ -546,7 +520,7 @@ VERIFY_RESULT PvpVerifyFileWithAdditionalCatalog(
546520
PhSkipStringRef(&remainingFileName, windowsAppsPath->Length);
547521
indexOfBackslash = PhFindCharInStringRef(&remainingFileName, OBJ_NAME_PATH_SEPARATOR, FALSE);
548522

549-
if (indexOfBackslash != -1)
523+
if (indexOfBackslash != SIZE_MAX)
550524
{
551525
baseFileName.Buffer = FileName->Buffer;
552526
baseFileName.Length = windowsAppsPath->Length + indexOfBackslash * sizeof(WCHAR);
@@ -818,7 +792,6 @@ VOID PvpSetPeImageSize(
818792
PPH_STRING string;
819793
ULONG lastRawDataAddress = 0;
820794
ULONG64 lastRawDataOffset = 0;
821-
ULONG64 lastRawDataAddressSize = 0;
822795

823796
// https://reverseengineering.stackexchange.com/questions/2014/how-can-one-extract-the-appended-data-of-a-portable-executable/2015#2015
824797

@@ -907,13 +880,38 @@ VOID PvpSetPeImageCheckSum(
907880
string = PhFormatString(L"0x%I32x (verifying...)", PvMappedImage.NtHeaders->OptionalHeader.CheckSum); // same for 32-bit and 64-bit images
908881

909882
PhSetListViewSubItem(ListViewHandle, PVP_IMAGE_GENERAL_INDEX_CHECKSUM, 1, string->Buffer);
910-
PhSetListViewSubItem(ListViewHandle, PVP_IMAGE_GENERAL_INDEX_CHECKSUMIAT, 1, L"(verifying...)");
911883

912884
PhQueueItemWorkQueue(PhGetGlobalWorkQueue(), CheckSumImageThreadStart, WindowHandle);
913885

914886
PhDereferenceObject(string);
915887
}
916888

889+
VOID PvpSetPeImageSpareHeaderBytes(
890+
_In_ HWND ListViewHandle
891+
)
892+
{
893+
if (PvMappedImage.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)
894+
{
895+
ULONG nativeHeadersLength = PtrToUlong(PTR_SUB_OFFSET(PvMappedImage.NtHeaders32, PvMappedImage.ViewBase));
896+
ULONG optionalHeadersLength = UFIELD_OFFSET(IMAGE_NT_HEADERS32, OptionalHeader) + PvMappedImage.NtHeaders32->FileHeader.SizeOfOptionalHeader;
897+
ULONG sectionsLength = PvMappedImage.NtHeaders32->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
898+
ULONG totalLength = nativeHeadersLength + optionalHeadersLength + sectionsLength;
899+
ULONG spareLength = PtrToUlong(PTR_SUB_OFFSET(PvMappedImage.NtHeaders32->OptionalHeader.SizeOfHeaders, totalLength));
900+
901+
PhSetListViewSubItem(ListViewHandle, PVP_IMAGE_GENERAL_INDEX_HEADERSPARE, 1, PhaFormatSize(spareLength, ULONG_MAX)->Buffer);
902+
}
903+
else if (PvMappedImage.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
904+
{
905+
ULONG nativeHeadersLength = PtrToUlong(PTR_SUB_OFFSET(PvMappedImage.NtHeaders, PvMappedImage.ViewBase));
906+
ULONG optionalHeadersLength = UFIELD_OFFSET(IMAGE_NT_HEADERS64, OptionalHeader) + PvMappedImage.NtHeaders->FileHeader.SizeOfOptionalHeader;
907+
ULONG sectionsLength = PvMappedImage.NtHeaders->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
908+
ULONG totalLength = nativeHeadersLength + optionalHeadersLength + sectionsLength;
909+
ULONG spareLength = PtrToUlong(PTR_SUB_OFFSET(PvMappedImage.NtHeaders->OptionalHeader.SizeOfHeaders, totalLength));
910+
911+
PhSetListViewSubItem(ListViewHandle, PVP_IMAGE_GENERAL_INDEX_HEADERSPARE, 1, PhaFormatSize(spareLength, ULONG_MAX)->Buffer);
912+
}
913+
}
914+
917915
VOID PvpSetPeImageSubsystem(
918916
_In_ HWND ListViewHandle
919917
)
@@ -1045,14 +1043,14 @@ VOID PvpSetPeImageCharacteristics(
10451043
&debugEntry
10461044
)))
10471045
{
1048-
ULONG characteristics = ULONG_MAX;
1046+
ULONG characteristicsEx = ULONG_MAX;
10491047

10501048
if (debugEntryLength == sizeof(ULONG))
1051-
characteristics = *(ULONG*)debugEntry;
1049+
characteristicsEx = *(ULONG*)debugEntry;
10521050

1053-
if (characteristics != ULONG_MAX)
1051+
if (characteristicsEx != ULONG_MAX)
10541052
{
1055-
if (characteristics & IMAGE_DLLCHARACTERISTICS_EX_CET_COMPAT)
1053+
if (characteristicsEx & IMAGE_DLLCHARACTERISTICS_EX_CET_COMPAT)
10561054
PhAppendStringBuilder2(&stringBuilder, L"CET compatible, ");
10571055
}
10581056
}
@@ -1382,7 +1380,8 @@ VOID PvpSetPeImageProperties(
13821380
PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_IMAGESIZE, L"Image size", NULL);
13831381
PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_ENTRYPOINT, L"Entry point", NULL);
13841382
PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_CHECKSUM, L"Header checksum", NULL);
1385-
PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_CHECKSUMIAT, L"Import checksum", NULL);
1383+
//PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_CHECKSUMIAT, L"Import checksum", NULL);
1384+
PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_HEADERSPARE, L"Header spare", NULL);
13861385
PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_SUBSYSTEM, L"Subsystem", NULL);
13871386
PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_SUBSYSTEMVERSION, L"Subsystem version", NULL);
13881387
PhAddListViewGroupItem(Context->ListViewHandle, PVP_IMAGE_GENERAL_CATEGORY_BASICINFO, PVP_IMAGE_GENERAL_INDEX_CHARACTERISTICS, L"Characteristics", NULL);
@@ -1403,6 +1402,7 @@ VOID PvpSetPeImageProperties(
14031402
PvpSetPeImageSize(Context->ListViewHandle);
14041403
PvpSetPeImageEntryPoint(Context->ListViewHandle);
14051404
PvpSetPeImageCheckSum(Context->WindowHandle, Context->ListViewHandle);
1405+
PvpSetPeImageSpareHeaderBytes(Context->ListViewHandle);
14061406
PvpSetPeImageSubsystem(Context->ListViewHandle);
14071407
PvpSetPeImageCharacteristics(Context->ListViewHandle);
14081408
// File information
@@ -1621,13 +1621,11 @@ INT_PTR CALLBACK PvpPeGeneralDlgProc(
16211621
case PVM_CHECKSUM_DONE:
16221622
{
16231623
PPH_STRING string;
1624-
PPH_STRING importTableHash;
16251624
ULONG headerCheckSum;
16261625
ULONG realCheckSum;
16271626

16281627
headerCheckSum = PvMappedImage.NtHeaders->OptionalHeader.CheckSum; // same for 32-bit and 64-bit images
16291628
realCheckSum = (ULONG)wParam;
1630-
importTableHash = (PPH_STRING)lParam;
16311629

16321630
if (headerCheckSum == 0)
16331631
{
@@ -1648,12 +1646,6 @@ INT_PTR CALLBACK PvpPeGeneralDlgProc(
16481646
PhSetListViewSubItem(context->ListViewHandle, PVP_IMAGE_GENERAL_INDEX_CHECKSUM, 1, string->Buffer);
16491647
PhDereferenceObject(string);
16501648
}
1651-
1652-
if (importTableHash)
1653-
{
1654-
PhSetListViewSubItem(context->ListViewHandle, PVP_IMAGE_GENERAL_INDEX_CHECKSUMIAT, 1, PhGetStringOrEmpty(importTableHash));
1655-
PhDereferenceObject(importTableHash);
1656-
}
16571649
}
16581650
break;
16591651
case PVM_VERIFY_DONE:

‎tools/peview/pesectionprp.c

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -170,12 +170,20 @@ VOID PvSetPeImageSections(
170170
PhPrintUInt32(value, i + 1);
171171
lvItemIndex = PhAddListViewItem(ListViewHandle, MAXINT, value, &PvMappedImage.Sections[i]);
172172
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 1, sectionName);
173-
PhPrintPointer(value, UlongToPtr(PvMappedImage.Sections[i].VirtualAddress));
173+
174+
PhPrintPointer(value, UlongToPtr(PvMappedImage.Sections[i].PointerToRawData));
174175
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 2, value);
175-
PhPrintPointer(value, PTR_ADD_OFFSET(PvMappedImage.Sections[i].VirtualAddress, PvMappedImage.Sections[i].SizeOfRawData));
176+
PhPrintPointer(value, PTR_ADD_OFFSET(PvMappedImage.Sections[i].PointerToRawData, PvMappedImage.Sections[i].SizeOfRawData));
176177
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 3, value);
177178
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 4, PhaFormatSize(PvMappedImage.Sections[i].SizeOfRawData, ULONG_MAX)->Buffer);
178-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 5, PH_AUTO_T(PH_STRING, PvGetSectionCharacteristics(PvMappedImage.Sections[i].Characteristics))->Buffer);
179+
180+
PhPrintPointer(value, UlongToPtr(PvMappedImage.Sections[i].VirtualAddress));
181+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 5, value);
182+
PhPrintPointer(value, PTR_ADD_OFFSET(PvMappedImage.Sections[i].VirtualAddress, PvMappedImage.Sections[i].Misc.VirtualSize));
183+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 6, value);
184+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 7, PhaFormatSize(PvMappedImage.Sections[i].Misc.VirtualSize, ULONG_MAX)->Buffer);
185+
186+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 8, PH_AUTO_T(PH_STRING, PvGetSectionCharacteristics(PvMappedImage.Sections[i].Characteristics))->Buffer);
179187

180188
if (PvMappedImage.Sections[i].VirtualAddress && PvMappedImage.Sections[i].SizeOfRawData)
181189
{
@@ -194,7 +202,7 @@ VOID PvSetPeImageSections(
194202
if (PhFinalHash(&hashContext, hash, 16, NULL))
195203
{
196204
hashString = PhBufferToHexString(hash, 16);
197-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 6, hashString->Buffer);
205+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 9, hashString->Buffer);
198206
PhDereferenceObject(hashString);
199207
}
200208
}
@@ -206,7 +214,7 @@ VOID PvSetPeImageSections(
206214
//message = PH_AUTO(PhGetNtMessage(GetExceptionCode()));
207215
message = PH_AUTO(PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode()))); // WIN32_FROM_NTSTATUS
208216

209-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 6, PhGetStringOrEmpty(message));
217+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 9, PhGetStringOrEmpty(message));
210218
}
211219
}
212220
}
@@ -251,11 +259,14 @@ INT_PTR CALLBACK PvPeSectionsDlgProc(
251259
PhSetControlTheme(context->ListViewHandle, L"explorer");
252260
PhAddListViewColumn(context->ListViewHandle, 0, 0, 0, LVCFMT_LEFT, 40, L"#");
253261
PhAddListViewColumn(context->ListViewHandle, 1, 1, 1, LVCFMT_LEFT, 80, L"Name");
254-
PhAddListViewColumn(context->ListViewHandle, 2, 2, 2, LVCFMT_LEFT, 100, L"RVA (start)");
255-
PhAddListViewColumn(context->ListViewHandle, 3, 3, 3, LVCFMT_LEFT, 100, L"RVA (end)");
256-
PhAddListViewColumn(context->ListViewHandle, 4, 4, 4, LVCFMT_LEFT, 80, L"Size");
257-
PhAddListViewColumn(context->ListViewHandle, 5, 5, 5, LVCFMT_LEFT, 250, L"Characteristics");
258-
PhAddListViewColumn(context->ListViewHandle, 6, 6, 6, LVCFMT_LEFT, 80, L"Hash");
262+
PhAddListViewColumn(context->ListViewHandle, 2, 2, 2, LVCFMT_LEFT, 100, L"RAW (start)");
263+
PhAddListViewColumn(context->ListViewHandle, 3, 3, 3, LVCFMT_LEFT, 100, L"RAW (end)");
264+
PhAddListViewColumn(context->ListViewHandle, 4, 4, 4, LVCFMT_LEFT, 80, L"RAW (size)");
265+
PhAddListViewColumn(context->ListViewHandle, 5, 5, 5, LVCFMT_LEFT, 100, L"RVA (start)");
266+
PhAddListViewColumn(context->ListViewHandle, 6, 6, 6, LVCFMT_LEFT, 100, L"RVA (end)");
267+
PhAddListViewColumn(context->ListViewHandle, 7, 7, 7, LVCFMT_LEFT, 80, L"RVA (size)");
268+
PhAddListViewColumn(context->ListViewHandle, 8, 8, 8, LVCFMT_LEFT, 250, L"Characteristics");
269+
PhAddListViewColumn(context->ListViewHandle, 9, 9, 9, LVCFMT_LEFT, 80, L"Hash");
259270
//ExtendedListView_SetItemColorFunction(context->ListViewHandle, PvPeCharacteristicsColorFunction);
260271
ExtendedListView_SetCompareFunction(context->ListViewHandle, 1, PvPeVirtualAddressCompareFunction);
261272
ExtendedListView_SetCompareFunction(context->ListViewHandle, 2, PvPeSizeOfRawDataCompareFunction);

‎tools/peview/peview.rc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,11 +410,13 @@ STYLE DS_SETFONT | DS_MODALFRAME | DS_FIXEDSYS | WS_POPUP | WS_CAPTION | WS_SYSM
410410
CAPTION "ProdID"
411411
FONT 8, "MS Shell Dlg", 400, 0, 0x1
412412
BEGIN
413-
CONTROL "",IDC_LIST,"SysListView32",LVS_REPORT | LVS_SHOWSELALWAYS | LVS_ALIGNLEFT | WS_TABSTOP,0,38,300,242
413+
CONTROL "",IDC_LIST,"SysListView32",LVS_REPORT | LVS_SHOWSELALWAYS | LVS_ALIGNLEFT | WS_TABSTOP,0,52,300,228
414414
LTEXT "Checksum:",IDC_STATIC,7,7,38,8
415415
EDITTEXT IDC_PRODCHECKSUM,58,7,217,12,ES_AUTOHSCROLL | ES_READONLY | NOT WS_BORDER
416-
LTEXT "Hash:",IDC_STATIC,7,21,38,8
416+
LTEXT "Hash (raw):",IDC_STATIC,7,21,38,8
417417
EDITTEXT IDC_PRODHASH,58,21,217,12,ES_AUTOHSCROLL | ES_READONLY | NOT WS_BORDER
418+
LTEXT "Hash:",IDC_STATIC,7,35,38,8
419+
EDITTEXT IDC_PRODHASH2,58,35,217,12,ES_AUTOHSCROLL | ES_READONLY | NOT WS_BORDER
418420
END
419421

420422
IDD_PEDEBUG DIALOGEX 0, 0, 300, 280

‎tools/peview/resource.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@
6464
#define IDC_PREVIEW 1023
6565
#define IDC_PRODCHECKSUM 1025
6666
#define IDC_PRODHASH 1026
67+
#define IDC_PRODHASH2 1027
6768
#define IDC_FONT 1079
6869
#define IDC_GOTO 1079
6970
#define IDC_RESET 1086

0 commit comments

Comments
 (0)