================================
PE Viewer 3.0
================================

The plugin is designed to view information about PE format modules (EXE, DLL, DRV, SYS, OCX, COM, etc.).
Shows the functions imported and exported by the module, detailed information about module sections and headers, digital signatures and certificates, the CLR header of the .Net assembly, and the resources contained in the module.

Link to download the plugin and forum discussion:
http://totalcmd.net/plugring/peviewer3.html
https://wincmd.ru/plugring/peviewer3.html

================================
Help. Usage Description:
================================

Main form:
1) The algorithm for opening files by the plugin has been changed. Removed "detect" string generation. Be sure to delete the "detect" line in the "Total Commander" configuration file after installing the plugin to be able to open files of any extension.
File check algorithm (folders are ignored):
  a) If the file extension is included in the list of known PE files, then we go to the execution and creation of the GUI. Even if the file is corrupted, the user will receive a message. The idea is to ALWAYS create a GUI for known extensions.
Well-known extensions: 'EXE', 'DLL', 'DRV', 'SYS', 'OCX', 'COM', 'AX', 'CPL', 'SO', 'SCR', 'MUI', 'ACM' , 'BPL', 'EFI', 'WINMD', 'TSP', 'WLX', 'WFX', 'WDX', 'WCX', 'WLX64', 'WFX64', 'WDX64', 'WCX64'.
  b) File with unknown extension. If the file contains the correct markers MZ, PE and type Machine, then we go to the execution and creation of the GUI.
  c) If the file does not pass these checks, then nothing is executed and "Lister" passes control to the next plugin in priority.
2) The "Help" submenu contains a list of "ReadMe_???.txt" files from the plugin installation folder. Selecting a menu item opens the corresponding file in the OS-associated editor. In these files, the description of the main features of the plugin and version changes are updated. A must read.

"Info" form:
1) To analyze the compiler, the signature databases of the projects "PETools / PE Sniffer" (Signs.txt) and "PEiD" (UserDB.txt) are used. The two analysis methods use only the search starting from the OEP.
2) If there are corresponding structures, the "Rich Header" and "CLR Header" fields are displayed or not.

"Export / Import" form:
Description of the statuses of imported modules:
1) Empty line, black color - the library is found, loaded and all functions are also found.
2) Exclamation point in a triangle or letter "E", red color - library not found.
3) Exclamation point in a triangle or letter "E", violet color - the library is found, loaded, but some functions are missing in it.
4) Hourglass or letter "D", the color reflects the meaning of the first three points - delay import of the library.

"Resources" form:
1) An algorithm for automatically determining the data format for displaying each resource has been implemented.
Current supported formats: Strings, JPG, PNG, GIF, BMP, ICO and Delphi resources (TPF0, 'PACKAGEINFO', 'PACKAGEOPTIONS', 'DVCLAL', 'PLATFORMTARGETS', 'DESCRIPTION', 'BORLAND_SIG').
Each data format is assigned a corresponding icon in the tree and an extension when saving.
2) Implemented the ability to save all resources (see the "Keys" section).
When saving multiple resources, a folder is created with the name of the corresponding root node and the selected child elements are copied into.
When you save root resources, folders are created with the name of the corresponding root node, into which all child elements are copied.
3) Implemented the ability to copy graphic resources to the clipboard.

Keys:
1) To navigate through the forms (tabs), use the keyboard shortcuts Ctrl+Tab (forward) and Ctrl+Shift+Tab (back).
2) Tab (forward) and Shift+Tab (back) key combinations are used to bypass components inside the form, and Enter (forward) and Shift+Enter (back) for "Quick View" mode.
3) List and tree graphic components support multiple selection of elements using the Ctrl and Shift keys. In tree graphical components, you can only select nodes of the same level.
4) Use the F12 key to open the settings menu.
5) Tree and list components support searching for elements when typing their name from the keyboard. The search is case-insensitive and only from the beginning of a word.

Configuration file:
1) Name of the plugin parameters section [PEViewer].
2) Settings menu options:
- ActiveTab=ctInfo - default value. The name of the active tab. Valid values: ctInfo, ctImport, ctExport, ctHeaders, ctResources, ctSignatures, ctCLRHeader.
- RememberActiveTab=True - default value. Whether or not to remember the active tab.
- Language= - default value. Plugin localization languages. Valid values: empty value - internal English, English, Belarusian, Deutsch, Russian, Ukrainian.
- UseLSPluginIni. If UseLSPluginIni=True, then the lsplugin.ini file is used to store the plugin parameters (the "Total Commander" configuration file for WLX plugins, the location is specified by the user), otherwise the PEViewer.ini file in the plugin folder is used.
If the PEViewer.ini file is missing, then the option UseLSPluginIni=True.
If the PEViewer.ini file exists, the UseLSPluginIni value is read. If there is no parameter, then UseLSPluginIni=False.

================================
Change Log:
================================

3.0.12
[+] Added a new form "Debug".
[+] Added the "On Top Of Windows" option to the settings menu.
[+] For the "Import" form, the label has been added to display the number of delay import modules.
[+] For the "Sections / Headings" form, highlighting of the validity of the "Data Directories" and "ImageBase" fields has been added.
[*] For the list component, the error in copying a line with an empty caption has been fixed.
[*] For the "Resources" form, the problem with "Select all" not working from the context menu of the tree element has been fixed.
[*] For the "Resources" form, the problem of hot keys not working for the list of properties of the current resource has been fixed.
[*] For the "Resources" form, full copying of text resources to the clipboard without the need for selection has been implemented.
[*] For the "Resources" form, the error in displaying the size of the icon or cursor has been fixed.
[*] For the "Resources" form, the display of the Accelerator resource has been improved.
[*] For the "Import" form, loading of modules without an extension has been fixed.
[*] For the "Import" form, the sorting of functions by "Ordinal" has been fixed.
[*] For the "Sections / Headings" form, the error in displaying the number of "Data Directories" elements has been fixed.
[*] Fixed error in reading section headers.
[*] Fixed error in reading the certificate table.
[*] Fixed an error in reading the import table.
[*] Fixed an error in reading the delay import table.

3.0.11
[+] Support for Windows XP has been implemented. Fixed: display of Unicode characters, dark text of the selected tab, resource saving dialogs, height of the resource properties panel and section list.
[+] Added a German localization file for the program.
[+] Copying the text of the summary information tab and the error description tab to the clipboard by clicking the mouse has been implemented.
[*] For the "Info" form, the error in displaying the multilingual resource VERSION has been fixed.
[*] For the "Import" form, the error in loading the import table has been fixed.
[*] For the "Import" form, the error in finding the path for the "Universal CRT" modules has been fixed.
[*] For the "Import" form, the "Number" column of the list component of the module functions has been added. Functions that do not have a name and are called through a sequence number.
[*] For the "Resources" form, the error in displaying the "ID" of the resource string "String" for the third nesting level has been fixed.
[*] For the "Resources" form, the algorithm for recursive saving of resources has been improved.
[*] Small icons of resource tree nodes have been corrected for the Resources form.
[*] For the list component, the error of overwriting column labels has been fixed.
[*] For the list component, the error in calculating the width of the last column has been fixed.
[*] Fixed display of "Message Table" resources.
[*] Configuration file parameters have been renamed. Changed plugin parameter to use lsplugin.ini. Described in detail in the help.

3.0.10
[+] Added a new form "CLR Header". For .Net assemblies, the target platform is added to the information label.
[+] Implemented "Dark Mode". Installed automatically based on the TC theme. Grid is disabled for list components.
[+] For the "Resources" form, an algorithm for determining text resources (ANSI, UNICODE16LE, UNICODE16BE and UTF8) has been implemented. See Windows OS components.
[+] Support for new resource types "MUI", "HTML" and "REGISTRY" has been added for the "Resources" form.
[+] A properties panel for the current resource has been added to the "Resources" form.
[+] A plugin version item has been added to the settings menu. When clicked, the plugin web page opens.
[*] The "Import / Export" form is divided into two separate forms: "Import" and "Export".
[*] For the "Export" form, the list component is switched to virtual mode. It is now possible to view over 20,000 exported functions.
[*] For the "Digital Signatures" form, "Status" verification fields for signatures and certificates have been added. "Type" field for signatures. Added names in X500 format for "Subject" and "Issuer". Long fields are hidden in child nodes.
[*] Display in HEX mode has been fixed for the Resources form.
[*] For the "Resources" form, the display of broken resources has been improved.
[*] For the "Import" form, the problem with displaying Unicode characters for the "Status" column has been fixed.
[*] Fixed sorting of the last column of the list component.
[*] Flickering of components during fast transitions in the "Quick View" TC mode has been eliminated.
[*] The code for applying localization without re-reading data has been improved.
[*] For forms, the display of separators and their correct position when loading have been improved.

3.0.9
[+] Added support for PE format for "ARMNT", "ARM64" and "Intel AI64" (Itanium) architectures.
[+] For the "Digital Signatures" form, parsing of the "Extensions", "Public Key" and "Encrypted Hash" fields has been implemented. Improved information display.
[+] For the "Resources" form, the text information output component has been replaced. Unicode support has been implemented.
[*] The output of brief information about the format, architecture and byte order has been updated.
[*] The "MachineType" description lines have been corrected.
[*] Improved definition of DOS format.
[*] Fixed a bug in applying localization.

3.0.8
[*] For the "Info" form, the error loading the "VersionInfo" resource has been fixed.
[*] For the "Resources" form, the error loading resources has been fixed.
[+] A new tab "Digital Signatures" has been added.
[+] For the "Resources" form, support for new resource types "Accelerator" and "Message Table" has been added.
[+] For the tree component, the context menu items "Copy Value" and "Copy Name" have been added.

3.0.7
[*] For the "Sections / Headers" form fixed an error of copying contents of tree nodes (Ctrl+C).
[*] Fixed bug of applying localization when opening two or more Listers.
[*] The algorithms for searching for signatures using the "PEiD" and "PE Sniffer" databases have been reworked.
[*] For the "Info" form, a permanent compiler definition has been implemented.
[+] For the "Info" form added output of MD5 and SHA1 file hashes.
[+] For the "Export / Import" form a waiting window is implemented when performing long calculation operations.
[*] Reworked the code for reading and saving settings to a configuration file. Removed the use of the PEViewer_config.ini file. You can set font size, style, and color for each tab separately. It is described in detail in the help.

3.0.6
[*] Fixed error of reading "StringTable" structure with empty elements.
[*] Fixed a bug in loading the delay import catalog.
[*] Fixed error of loading a file with "IMAGE_NT_HEADERS" structure equalized at the 2Kb boundary.
[*] Fixed bug of searching for dependent modules.
[*] Fixed the problem of intermediate resizing and redraws when embedding the plugin's main form in the owner window. The effect is noticeable in "Quick View" mode when going through the list of files.
[*] For the "Sections / Headers" form fixed an error in displaying the description of "Flags" sections for the "Align" value.
[*] For the "Resources" form fixed the error of resource language code loss displayed in the status line.
[*] For the "Resources" form fixed hotkeys for resource display modes Ctrl+1-4.
[*] For the "Resources" form fixed vertical separator placement error.
[*] For the "Resources" form fixed the error of losing focus when canceling the save dialog.
[*] Fixed the algorithm for selecting and focusing components.
[*] AutoSize of columns of the list component has been improved.
[+] For the "Resources" form the algorithm of automatic detection of data formats for display has been implemented. It is described in detail in the help.
[+] For the "Info" form, the display of the "Characteristics", "DllCharacteristics" and "File Accessed" fields has been added.
[+] For the "Info" form, the display of the presence of the "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR" structure (CLR Header) has been added. One of the hallmarks of a .Net application.
[+] For the "Info" form, the presence of the headers "Rich Header" and "CLR Header" is highlighted.
[+] For the "Quick View" mode, additional keys for bypassing components inside the form (Enter and Shift+Enter) have been added. It is described in detail in the help.
[+] For the "Resources" form the copying of images to the clipboard has been implemented.
[+] For the "Resources" form, the component of the list of icons or cursors is hidden if it contains only one element.
[+] Added "Help" element to the main form in the settings menu.
[+] For the main form, the settings menu can be opened by pressing F12.
[*] The algorithm for opening files by the plugin has been changed. Removed "detect" string generation. It is described in detail in the help.
[*] For the "Export / Import" form, the processing time for structures of imported and exported functions has been reduced.
[*] For the "Export / Import" form, the time for building and checking imported modules and their functions has been reduced.
[*] For the "Resources" form, the function of saving graphic files has been redesigned. Also fixed the code for correctly saving "Bitmap" resources.
[*] Improved algorithm for detecting PE files.
[*] Improved code for displaying "Language" and "CodePage" on the "Info" and "Resources" forms.
[*] Reading of the list of elements of structures "StringFileInfo" and "VarFileInfo" is implemented.
[*] For the "Export / Import" form, symbolic display of module status has been simplified. It is described in detail in the help.
[*] For the "Resources" form, the display of strings from the resource of a packed file has been fixed. Now an inscription about the incorrectness of the data is displayed.
[*] For the "Resources" form, the rendering of graphic files has been improved and parasitic flickering of components has been eliminated.
[*] For the "Sections / Headers" form, the tree nodes "IMAGE_FILE_HEADER" and "IMAGE_OPTIONAL_HEADER" are expanded by default.
[*] Corrections of program localizations.
[*] Internal code optimization.

3.0.5
[+] For the "Headers / Sections" form display of the "Rich Header" structure has been implemented. A checksum verification algorithm has also been implemented. If the checksum is incorrect, "CheckSum" is displayed in red.
[+] For the "Info" form the presence of the "Rich Header" structure is displayed.
[+] For the "Headers / Sections" form backlighting of the "CheckSum" and "Data Directories" tree elements has been implemented.
[*] Fixed handling of number keys 1-8 in Lister.
[*] For the "Export / Import" form fixed error of "Delay" status loss (hourglass) for imported libraries.
[*] Internal code optimization.

3.0.4
[*] Updated and fixed flags for PE structures: "Section Flags", "Machine Types", "Characteristics", "Windows Subsystem" and "DLL Characteristics".
[*] Fixes for the fields of the IMAGE_OPTIONAL_HEADER structure.
[*] Fixed error in determining file offset address for exported functions.
[*] Fixed handling of F3, F5, F7 and Backspace keys in Lister.
[*] Fixed error when the program loses focus when canceling the save resources dialog.
[*] Localization fixes for the program.
[+] Using double buffering to draw the content of all forms.
[+] Use the same font for all forms.
[+] Ability to navigate through components using the Tab/Shift+Tab keys.
[+] For the status bar of the "Resources" form added ability to copy text by double mouse click.
[+] For the "Headers / Sections" form backlighting of some elements of the tree is implemented.
[*] For the "Headers / Sections" form transition from a list element to the corresponding tree element by double mouse click or Enter key is implemented.
[*] For the "Headers / Sections" form a single hotkey for copying text data Ctrl+C is assigned.
[*] For the "Headers / Sections" form hexadecimal output of the value itself has been added to the string format of field data.
[*] For the "Headers / Sections" form the "Attributes" column contains a text description.
[*] Internal code optimization.

3.0.3
[*] The algorithm for reading versioned structures has been redesigned. Now information for C# modules is displayed correctly.
[*] For the "Export/Import" form added error output when reading import and export sections. Necessary for packed modules.
[*] The display order of information data blocks on the "Info" and "Resources" forms (Version element) has been changed.
[*] Redesigned context menu. Added item "Copy name". Hotkey combinations have been changed.
[+] Added support for *.DRV, *.EFI and *.WINMD files.
[+] Added files of Belarusian and Ukrainian localizations of the program.
[+] Added the "Catalog" column for imported modules.
[*] GUI fixes.
[*] Localization fixes for the program.
[*] Eliminated program execution exceptions.
[*] Internal code optimization.

3.0.2
[+] Added the ability to group save resources.
[+] Added the ability to view PNG resources.
[+] Added English localization file for the program.
[*] GUI fixes.
[*] Localization fixes for the program.
[*] Internal code optimization.

3.0.1
[*] The project was rebuilt by Embarcadero 11.3.1.
[*] Fixed errors in the 64th version of the plugin.
[*] Fixed GUI bugs.
[*] Fixed errors in the display of different types of resources.
[*] Internal code optimization.
[*] The custom graphics components have been replaced by the standard ones.
[*] The PEid database has been updated.
[+] Added support for High DPI.
