* Some resource code refactoring

+ MakeIntResource
* Units for special resource parsing, like PE.Resources.Windows.Bitmap should parse from given stream position.
  Position must be properly initialized before parsing.
+ PE.Resources.Windows.Strings unit (to parse RT_STRING/string bundles)
+ [temp] can be moved to other units later:
  + PeGetFileVersionInfo (analogue to Windows GetFileVersionInfo)
  + PeVerQueryValueFixed (analogue to Windows VerQueryValue for fixed ver. info.)

Author: vdisasmdev

PE.ExecutableLoader.pas

@@ -342,7 +342,7 @@ function TExecutableModule.LoadImports: TMapStatus;
       end;
 
       // Patch.
-      va := FInstance + rva;
+      va := FInstance + RVA;
       if FPE.Is32bit then
         PUINT(va)^ := UInt32(proc)
       else if FPE.Is64bit then
@@ -351,7 +351,7 @@ function TExecutableModule.LoadImports: TMapStatus;
       inc(RVA, FPE.ImageWordSize);
     end;
 
-    inc(RVA, FPE.ImageWordSize); // null
+    // inc(RVA, FPE.ImageWordSize); // null
   end;
   Result := msOK;
 end;

PE.Image.x86.pas

@@ -9,6 +9,7 @@ interface
 
 uses
   System.Generics.Collections,
+  System.SysUtils,
   PE.Common,
   PE.Image,
   PE.Section;

PE.Resources.VersionInfo.pas

@@ -14,24 +14,9 @@ interface
   PE.Common,
   PE.Utils;
 
-type
-  // http://msdn.microsoft.com/en-us/library/windows/desktop/ms646997(v=vs.85).aspx
-  VS_FIXEDFILEINFO = packed record
-    dwSignature: uint32; // 0xFEEF04BD
-    dwStrucVersion: uint32;
-    dwFileVersionMS: uint32;
-    dwFileVersionLS: uint32;
-    dwProductVersionMS: uint32;
-    dwProductVersionLS: uint32;
-    dwFileFlagsMask: uint32;
-    dwFileFlags: uint32; // VS_FF...
-    dwFileOS: uint32;
-    dwFileType: uint32;
-    dwFileSubtype: uint32;
-    dwFileDateMS: uint32;
-    dwFileDateLS: uint32;
-  end;
+{$i 'VerRsrc.inc'}
 
+type
   TBlock = class;
   TBlockList = TObjectList<TBlock>;
   TBlockClass = class of TBlock;
@@ -102,37 +87,6 @@   TPEVersionInfo = class
 
 implementation
 
-const
-  SIG_VS_FIXEDFILEINFO = $FEEF04BD;
-
-  // dwFileFlags
-  VS_FF_DEBUG        = $1;
-  VS_FF_PRERELEASE   = $2;
-  VS_FF_PATCHED      = $4;
-  VS_FF_PRIVATEBUILD = $8;
-  VS_FF_INFOINFERRED = $10;
-  VS_FF_SPECIALBUILD = $20;
-
-  // dwFileOS
-  VOS_UNKNOWN    = $00000000;
-  VOS__WINDOWS16 = $00000001;
-  VOS__PM16      = $00000002;
-  VOS__PM32      = $00000003;
-  VOS__WINDOWS32 = $00000004;
-  VOS_DOS        = $00010000;
-  VOS_OS216      = $00020000;
-  VOS_OS232      = $00030000;
-  VOS_NT         = $00040000;
-
-  // dwFileType
-  VFT_UNKNOWN    = $00000000;
-  VFT_APP        = $00000001;
-  VFT_DLL        = $00000002;
-  VFT_DRV        = $00000003;
-  VFT_FONT       = $00000004;
-  VFT_VXD        = $00000005;
-  VFT_STATIC_LIB = $00000007;
-
 type
   TVersionInfoBlockHeader = packed record
     Length: uint16;      // block length w/o padding

PE.Resources.Windows.Bitmap.pas

@@ -44,7 +44,6 @@ function ParseBitmapResource(const Stream: TStream): TStream;
   BmpHdr: TBitmapFileHeader;
   InfoHdr: TBitmapInfoHeader;
 begin
-  Stream.Position := 0;
   if not StreamRead(Stream, InfoHdr, SizeOf(InfoHdr)) then
     raise Exception.Create('Stream too small.');
 

PE.Resources.Windows.Strings.pas

@@ -0,0 +1,113 @@
+unit PE.Resources.Windows.Strings;
+
+interface
+
+uses
+  System.Classes,
+  System.SysUtils;
+
+type
+  TStringBundleID = uint32;
+
+  TResourceStringBundle = class
+  public
+    id: TStringBundleID;
+    Strings: TStringList;
+
+    function GetStringId(stringNumber: cardinal): cardinal;
+
+    constructor Create(id: TStringBundleID);
+    destructor Destroy; override;
+
+    procedure LoadFromStream(Stream: TStream);
+  end;
+
+function BundleToStringId(bundleID: TStringBundleID): cardinal; inline;
+
+// Parse string bundle.
+function ParseStringResource(const Stream: TStream; bundleID: TStringBundleID): TResourceStringBundle;
+
+implementation
+
+{
+  see
+  https://msdn.microsoft.com/en-us/library/windows/desktop/aa381050
+  http://blogs.msdn.com/b/oldnewthing/archive/2004/01/30/65013.aspx
+}
+
+// Bundle id to first string id in block of 16 strings.
+function BundleToStringId(bundleID: TStringBundleID): cardinal;
+begin
+  if bundleID < 1 then
+    raise Exception.Create('Wrong bundle id.');
+  result := (bundleID - 1) * 16;
+end;
+
+{ TResourceStringBundle }
+
+constructor TResourceStringBundle.Create(id: TStringBundleID);
+begin
+  self.id := id;
+  self.Strings := TStringList.Create;
+  self.Strings.Capacity := 16;
+end;
+
+destructor TResourceStringBundle.Destroy;
+begin
+  Strings.Free;
+  inherited;
+end;
+
+function TResourceStringBundle.GetStringId(stringNumber: cardinal): cardinal;
+begin
+  result := BundleToStringId(id) + stringNumber;
+end;
+
+procedure TResourceStringBundle.LoadFromStream(Stream: TStream);
+var
+  dwLen: uint16;
+  allocLen: integer;
+  bytes: TBytes;
+  str: string;
+begin
+  self.Strings.Clear;
+
+  while Stream.Position < Stream.Size do
+  begin
+    if Stream.Read(dwLen, 2) <> 2 then
+      raise Exception.Create('Failed to read string length.');
+
+    if dwLen = 0 then
+    begin
+      continue;
+    end;
+
+    dwLen := dwLen * 2; // 2 bytes per char
+
+    if length(bytes) < dwLen then
+    begin
+      allocLen := ((dwLen + 128) div 128) * 128;
+      setlength(bytes, allocLen);
+    end;
+
+    if Stream.Read(bytes, dwLen) <> dwLen then
+      raise Exception.Create('String read error.');
+
+    str := TEncoding.Unicode.GetString(bytes, 0, dwLen);
+
+    Strings.Add(str);
+  end;
+end;
+
+function ParseStringResource(const Stream: TStream; bundleID: TStringBundleID): TResourceStringBundle;
+begin
+  result := TResourceStringBundle.Create(bundleID);
+  try
+    result.LoadFromStream(Stream);
+  except
+    result.Free;
+    result := nil;
+  end;
+end;
+
+end.

PE.Resources.Windows.pas

@@ -13,7 +13,8 @@ interface
 uses
   System.Classes,
   PE.Image,
-  PE.Resources;
+  PE.Resources,
+  PE.Resources.VersionInfo;
 
 { Values for Windows PE. }
 
@@ -77,8 +78,7 @@ interface
 type
   TWindowsResourceTree = class
   private
-    function FindResourceInternal(lpType, lpName: PChar; Language: word;
-      Depth: cardinal): TResourceTreeNode;
+    function FindResourceInternal(lpType, lpName: PChar; Language: word; Depth: cardinal): TResourceTreeNode;
   protected
     FResourceTree: TResourceTree;
   public
@@ -101,8 +101,16 @@   TWindowsResourceTree = class
     function RemoveResource(lpType, lpName: PChar; Language: word): Boolean;
   end;
 
-function IsIntResource(lpszType: PChar): Boolean;
-function GetIntResource(lpszType: PChar): word;
+function IsIntResource(lpszType: PChar): Boolean; inline;
+function GetIntResource(lpszType: PChar): word; inline;
+function MakeIntResource(wInteger: uint16): PChar; inline;
+
+// See Windows GetFileVersionInfo function.
+// Find RT_VERSION raw data or nil if failed.
+// Don't Free returned stream because it's part of ResourceTree.
+function PeGetFileVersionInfo(img: TPEImage): TMemoryStream;
+
+function PeVerQueryValueFixed(stream: TStream; out value: VS_FIXEDFILEINFO): Boolean;
 
 implementation
 
@@ -119,6 +127,11 @@ function GetIntResource(lpszType: PChar): word; // inline;
   Result := NativeUInt(lpszType) and $FFFF;
 end;
 
+function MakeIntResource(wInteger: uint16): PChar;
+begin
+  Result := PChar(wInteger);
+end;
+
 constructor TWindowsResourceTree.Create(ResourceTree: TResourceTree);
 begin
   FResourceTree := ResourceTree;
@@ -241,4 +254,54 @@ procedure TWindowsResourceTree.UpdateResource(lpType, lpName: PChar;
   nLang.UpdateData(lpData, cbData);
 end;
 
+function PeGetFileVersionInfo(img: TPEImage): TMemoryStream;
+var
+  rt: TWindowsResourceTree;
+  versionBranch: TResourceTreeBranchNode;
+  versionLeaf: TResourceTreeLeafNode;
+begin
+  rt := TWindowsResourceTree.Create(img.ResourceTree);
+  try
+    versionBranch := rt.FindResource(MakeIntResource(RT_VERSION));
+    if assigned(versionBranch) and versionBranch.IsBranch and (versionBranch.Children.Count > 0) then
+    begin
+      versionBranch := TResourceTreeBranchNode(versionBranch.Children.First.K);
+      if assigned(versionBranch) and versionBranch.IsBranch and (versionBranch.Children.Count > 0) then
+      begin
+        versionLeaf := TResourceTreeLeafNode(versionBranch.Children.First.K);
+        if assigned(versionLeaf) and versionLeaf.IsLeaf then
+        begin
+          exit(versionLeaf.Data);
+        end;
+      end;
+    end;
+    exit(nil);
+  finally
+    rt.Free;
+  end;
+end;
+
+function PeVerQueryValueFixed(stream: TStream; out value: VS_FIXEDFILEINFO): Boolean;
+var
+  verInfo: TPEVersionInfo;
+  block: TBlock;
+begin
+  verInfo := TPEVersionInfo.Create;
+  try
+    verInfo.LoadFromStream(stream);
+
+    if assigned(verInfo.Root) then
+      for block in verInfo.Root.Children do
+        if block.ClassType = TBlockVersionInfo then
+        begin
+          value := TBlockVersionInfo(block).FixedInfo;
+          exit(True);
+        end;
+
+    exit(False);
+  finally
+    verInfo.Free;
+  end;
+end;
+
 end.

PE.Utils.pas

@@ -31,8 +31,8 @@ function StreamWriteStringA(AStream: TStream; const S: string; AlignAfter: integ
 const
   PATTERN_PADDINGX: array [0 .. 7] of AnsiChar = ('P', 'A', 'D', 'D', 'I', 'N', 'G', 'X');
 
-// Write pattern to stream. If Pattern is nil or size of patter is 0 then
-// nulls are written (default).
+  // Write pattern to stream. If Pattern is nil or size of patter is 0 then
+  // nulls are written (default).
 procedure WritePattern(AStream: TStream; Count: uint32; Pattern: Pointer = nil; PatternSize: integer = 0);
 
 function StreamSeek(AStream: TStream; Offset: TFileOffset): boolean; inline;
@@ -54,6 +54,8 @@ function IsStringASCII(const S: String): boolean;
 
 function CompareRVA(A, B: TRVA): integer; inline;
 
+function ReplaceSpecialSymobls(const source: string): string;
+
 implementation
 
 { Stream }
@@ -237,7 +239,7 @@ function AlignDown(Value: uint64; Align: uint32): uint64;
 
 function IsStringASCII(const S: String): boolean;
 var
-  c: char;
+  c: Char;
 begin
   for c in S do
     if not(integer(c) in [32 .. 126]) then
@@ -255,4 +257,11 @@ function CompareRVA(A, B: TRVA): integer;
     exit(0);
 end;
 
+function ReplaceSpecialSymobls(const source: string): string;
+begin
+  Result := source.
+    Replace(#10, '\n').
+    Replace(#13, '\r');
+end;
+
 end.