exeinfo.cpp

/*
ExeInfo 
Copyright © 2002 - 2004 Nir Sofer

This utility is released as freeware.
You are allowed to freely use, modify, and distribute it
as long as you don't remove the original copyright notice.
*/

#include "stdafx.h"
#include "stdlib.h"
#include <windows.h>
#include <winnt.h>
#include <stdio.h>
#include <iostream>
#include "exeinfo.h"
using namespace std;

bool machine_64 = false; /*variable for check x86_64*/

HANDLE OpenFileForRead(LPCSTR lpszFilename)
{
	return CreateFile(lpszFilename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
}

LPSTR KeyValueToStr(KEY_VALUE *Items, DWORD dwNumOfItems, DWORD dwFindValue, LPSTR lpszValue, LPSTR lpszDefaultValue = NULL)
{
	for (DWORD dwIndex = 0; dwIndex < dwNumOfItems; dwIndex++)
	if (Items[dwIndex].dwKey == dwFindValue)
	{
		strcpy(lpszValue, Items[dwIndex].szValue);
		return lpszValue;
	}


	if (lpszDefaultValue != NULL)
		strcpy(lpszValue, lpszDefaultValue);
	else
		lpszValue[0] = '\0';

	return lpszValue;

}


LPSTR KeyValueBitsToStr(KEY_VALUE *Items, DWORD dwNumOfItems, DWORD dwFindValue, LPSTR lpszValue)
{

	lpszValue[0] = '\0';

	for (DWORD dwIndex = 0; dwIndex < dwNumOfItems; dwIndex++)
	if ((Items[dwIndex].dwKey & dwFindValue) != 0)
	{
		if (lpszValue[0] != '\0')
			strcat(lpszValue, ", ");

		strcat(lpszValue, Items[dwIndex].szValue);
	}
	return lpszValue;

}

LPSTR GetSubsystemName(WORD wSubsystem, LPSTR lpszSubsystemName)
{
	const int  NumOfSubsystems = 8;
	KEY_VALUE Subsystems[NumOfSubsystems] = {
		{ IMAGE_SUBSYSTEM_UNKNOWN, "Unknown subsystem" },
		{ IMAGE_SUBSYSTEM_NATIVE, "Image doesn't require a subsystem" },
		{ IMAGE_SUBSYSTEM_WINDOWS_GUI, "Windows GUI" },
		{ IMAGE_SUBSYSTEM_WINDOWS_CUI, "Windows character subsystem (Console Application)" },
		{ IMAGE_SUBSYSTEM_OS2_CUI, "OS/2 character subsystem" },
		{ IMAGE_SUBSYSTEM_POSIX_CUI, "Posix character subsystem" },
		{ IMAGE_SUBSYSTEM_NATIVE_WINDOWS, "Native Win9x driver" },
		{ IMAGE_SUBSYSTEM_WINDOWS_CE_GUI, "Windows CE subsystem" } };


	return KeyValueToStr(Subsystems, NumOfSubsystems, wSubsystem, lpszSubsystemName, UNKNOWN_STR);
}

LPSTR GetSectionCharacteristics(DWORD dwCharacteristics, LPSTR lpszValue)
{
	const int  NumOfItems = 9;
	KEY_VALUE Items[NumOfItems] = {
		{ 0x00000020, "Code" },
		{ 0x00000040, "Initialized Data" },
		{ 0x00000080, "Uninitialized Data" },
		{ 0x04000000, "Not Cachable" },
		{ 0x08000000, "Not Pageable" },
		{ 0x10000000, "Shared" },
		{ 0x20000000, "Executable" },
		{ 0x40000000, "Readable" },
		{ 0x80000000, "Writable" } };

	return KeyValueBitsToStr(Items, NumOfItems, dwCharacteristics, lpszValue);
}

LPSTR GetNETargetOS(BYTE ExeType, LPSTR lpszOSName)
{
	const int  NumOfItems = 8;
	KEY_VALUE Items[NumOfItems] = {
		{ 0x0, "Unknown" },
		{ 0x1, "OS/2" },
		{ 0x2, "Windows" },
		{ 0x3, "European MS-DOS 4.x" },
		{ 0x4, "Windows 386" },
		{ 0x5, "BOSS (Borland Operating System Services)" },
		{ 0x81, "PharLap 286|DOS-Extender, OS/2" },
		{ 0x82, "PharLap 286|DOS-Extender, Windows" } };

	return KeyValueToStr(Items, NumOfItems, ExeType, lpszOSName, UNKNOWN_STR);
}

LPSTR GetMachineName(USHORT Machine, LPSTR lpszMachineName)
{
	const int NumOfMachines = 23;
	KEY_VALUE Machines[NumOfMachines] = {

		{ IMAGE_FILE_MACHINE_UNKNOWN, "Unknown" },
		{ IMAGE_FILE_MACHINE_AM33, "Matsushita AM33" },
		{ IMAGE_FILE_MACHINE_AMD64, "x64" },
		{ IMAGE_FILE_MACHINE_ARM, "ARM little endian" },
//		{ IMAGE_FILE_MACHINE_ARMNT, "ARMv7 (or higher) Thumb mode only" },
		{ IMAGE_FILE_MACHINE_ARM64, "ARMv8 in 64-bit mode" },
		{ IMAGE_FILE_MACHINE_EBC, "EFI byte code" },
		{ IMAGE_FILE_MACHINE_I386, "Intel 386 or later processors and compatible processors" },
		{ IMAGE_FILE_MACHINE_IA64, "Intel Itanium processor family" },
		{ IMAGE_FILE_MACHINE_M32R, "Mitsubishi M32R little endian" },
		{ IMAGE_FILE_MACHINE_MIPS16, "MIPS16" },
		{ IMAGE_FILE_MACHINE_MIPSFPU, "MIPS with FPU" },
		{ IMAGE_FILE_MACHINE_MIPSFPU16, "MIPS16 with FPU" },
		{ IMAGE_FILE_MACHINE_POWERPC, "Power PC little endian" },
		{ IMAGE_FILE_MACHINE_POWERPCFP, "Power PC with floating point support" },
		{ IMAGE_FILE_MACHINE_R4000, "MIPS little endian" },
		{ IMAGE_FILE_MACHINE_SH3, "Hitachi SH3" },
		{ IMAGE_FILE_MACHINE_SH3DSP, "Hitachi SH3 DSP" },
		{ IMAGE_FILE_MACHINE_SH4, "Hitachi SH4" },
		{ IMAGE_FILE_MACHINE_SH5, "Hitachi SH5" },
		{ IMAGE_FILE_MACHINE_THUMB, "ARM or Thumb (“interworking”)" },
		{ IMAGE_FILE_MACHINE_WCEMIPSV2, "MIPS little-endian WCE v2" },
		{ IMAGE_FILE_MACHINE_ALPHA64, "ALPHA64" }};

	return KeyValueToStr(Machines, NumOfMachines, Machine, lpszMachineName, UNKNOWN_STR);
}

BOOL GetInfoStr(char *pBuf, LPCWSTR lpszLang1, LPCWSTR lpszName, LPWSTR lpszInfo)
{
	UINT size;
	wchar_t  *str;
	wchar_t  szTemp[255];
	wcscpy(szTemp, L"\\StringFileInfo\\");
	wcscat(szTemp, lpszLang1);
	wcscat(szTemp, L"\\");
	wcscat(szTemp, lpszName);

	BOOL bFound = VerQueryValueW((LPVOID)pBuf, szTemp, (LPVOID *)&str, &size);
	if (bFound)
	{
		wcscpy(lpszInfo, str);
		return TRUE;
	}
	else return FALSE;
}

void GetInfoFromSectionHeaders(IMAGE_SECTION_HEADER *ishs, USHORT uNumOfSections, DWORD *dwInfo1)
{
	*dwInfo1 = 0;
	for (USHORT uIndex = 0; uIndex < uNumOfSections; uIndex++)
	{
		if (strncmp((char *)ishs[uIndex].Name, ".pklstb", 7) == 0) *dwInfo1 |= SECTIONS_HEADER_INFO_PKLITE;
		if (strncmp((char *)ishs[uIndex].Name, "_winzip_", 8) == 0) *dwInfo1 |= SECTIONS_HEADER_INFO_WINZIP;
		if (strncmp((char *)ishs[uIndex].Name, ".WWP32", 6) == 0) *dwInfo1 |= SECTIONS_HEADER_INFO_WWPACK32;
		if (strncmp((char *)ishs[uIndex].Name, "UPX", 3) == 0) *dwInfo1 |= SECTIONS_HEADER_INFO_UPX;

	}
}

LPSTR GetFileSubType(DWORD dwFileType, DWORD dwFileSubType, LPSTR lpszFileSubType)
{
	const int  NumOfTypes = 11;
	DWORD dwFileSubTypesIndex[NumOfTypes] = { VFT2_UNKNOWN, VFT2_DRV_COMM, VFT2_DRV_PRINTER, VFT2_DRV_KEYBOARD,
		VFT2_DRV_LANGUAGE, VFT2_DRV_DISPLAY, VFT2_DRV_MOUSE, VFT2_DRV_NETWORK,
		VFT2_DRV_SYSTEM, VFT2_DRV_INSTALLABLE, VFT2_DRV_SOUND };

	LPSTR szFileSubTypes[NumOfTypes] = { "Unknown", "Communications Driver", "Printer Driver", "Keyboard Driver", "Language Driver", "Display Driver", "Mouse Driver", "Network Driver", "System Driver", "Installable Driver", "Sound Driver" };

	strcpy(lpszFileSubType, "Unknown");
	if (dwFileType == VFT_DRV)
	{
		for (int nIndex = 0; nIndex < NumOfTypes; nIndex++)
		if (dwFileSubTypesIndex[nIndex] == dwFileSubType)
		{
			strcpy(lpszFileSubType, szFileSubTypes[nIndex]);
			break;
		}
	}
	else if (dwFileType == VFT_FONT)
	{
		if (dwFileSubType == VFT2_FONT_RASTER)
			strcpy(lpszFileSubType, "Raster Font");
		else if (dwFileSubType == VFT2_FONT_VECTOR)
			strcpy(lpszFileSubType, "Vector Font");
		else if (dwFileSubType == VFT2_FONT_TRUETYPE)
			strcpy(lpszFileSubType, "TrueType Font");

	}

	return lpszFileSubType;
}


LPSTR GetFileOSName(DWORD dwFileOS, LPSTR lpszOSName)
{
	const int  NumOfOS = 9;
	KEY_VALUE Items[NumOfOS] = {
		{ VOS_DOS, "MS-DOS" },
		{ VOS_NT, " Windows" },
		{ VOS__WINDOWS16, "Windows" },
		{ VOS__WINDOWS32, "Windows" },
		{ VOS_OS216, "16-bit OS/2" },
		{ VOS_OS232, "32-bit OS/2" },
		{ VOS__PM16, "16-bit Presentation Manager" },
		{ VOS__PM32, "32-bit Presentation Manager" },
		{ VOS_UNKNOWN, "Unknown" } };


	return KeyValueBitsToStr(Items, NumOfOS, dwFileOS, lpszOSName);
}

BOOL GetDosCompress(LPCSTR lpszMZHeader, LPSTR szCompressName)
{
	if (strncmp(&lpszMZHeader[0x1e], "PKLITE", 6) == 0)
	{
		sprintf(szCompressName, "PKLITE v%d.%d", (lpszMZHeader[0x1d] & 0xf), lpszMZHeader[0x1c]);
		return TRUE;
	}

	if (strncmp(&lpszMZHeader[0x1c], "LZ", 2) == 0)
	{
		char szVer[10] = "";
		if (strncmp(&lpszMZHeader[0x1e], "09", 2) == 0)
			strcpy(szVer, "0.90");
		else if (strncmp(&lpszMZHeader[0x1e], "91", 2) == 0)
			strcpy(szVer, "0.91");

		sprintf(szCompressName, "LZEXE %s", szVer);

		return TRUE;
	}

	if (strncmp(&lpszMZHeader[0x25], "LHarc's SFX", 11) == 0)
	{
		strcpy(szCompressName, "LHarc 1.x");
		return TRUE;
	}

	if (strncmp(&lpszMZHeader[0x24], "LHa's SFX", 9) == 0 ||
		strncmp(&lpszMZHeader[0x24], "LHA's SFX", 9) == 0)
	{
		strcpy(szCompressName, "LHA 2.x");
		return TRUE;
	}


	return FALSE;
}


LPSTR GetCharacteristics(WORD wCharacteristics, LPSTR lpszCharacteristics)
{
	const int  NumOfItems = 15;
	KEY_VALUE Items[NumOfItems] = {
		{ IMAGE_FILE_DLL, "The file is a dynamic-link library" },
		{ IMAGE_FILE_EXECUTABLE_IMAGE, "The file is executable"}, 
		{ IMAGE_FILE_RELOCS_STRIPPED, "Relocation info stripped from file" },
		{ IMAGE_FILE_LINE_NUMS_STRIPPED, "Line nunbers stripped from file" },
		{ IMAGE_FILE_LOCAL_SYMS_STRIPPED, "Local symbols stripped from file" },
		{ IMAGE_FILE_AGGRESIVE_WS_TRIM, "Agressively trim working set" },
		{ IMAGE_FILE_LARGE_ADDRESS_AWARE, "The application can handle addresses larger than 2gb" },
		{ IMAGE_FILE_BYTES_REVERSED_LO, "Bytes of machine word are reversed" },
		{ IMAGE_FILE_32BIT_MACHINE, "32 bit word machine"},
		{ IMAGE_FILE_DEBUG_STRIPPED, "Debugging info stripped from file in .DBG file" },
		{ IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP, "If Image is on removable media, copy and run from the swap file" },
		{ IMAGE_FILE_NET_RUN_FROM_SWAP, "If Image is on Net, copy and run from the swap file" },
		{ IMAGE_FILE_SYSTEM, "System File" },
		{ IMAGE_FILE_UP_SYSTEM_ONLY, "File should only be run on a UP machine" },
		{ IMAGE_FILE_BYTES_REVERSED_HI, "Bytes of machine word are reversed" } };

	lpszCharacteristics[0] = '\0';

	for (DWORD dwIndex = 0; dwIndex < NumOfItems; dwIndex++)
	if ((wCharacteristics & Items[dwIndex].dwKey) != 0)
	{
		strcat(lpszCharacteristics, "\r\n * ");
		strcat(lpszCharacteristics, Items[dwIndex].szValue);
	}
	if (machine_64)
		strcat(lpszCharacteristics, "\r\n * 64 bit word machine");

	return lpszCharacteristics;
}

LPSTR FormatFileTime(FILETIME ft, LPSTR szDateTime)
{
	SYSTEMTIME st;
	char szTime[15];

	FileTimeToSystemTime(&ft, &st);
	GetDateFormat(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &st, NULL, szDateTime, LINE_BUFFER_SIZE);
	GetTimeFormat(LOCALE_USER_DEFAULT, 0, &st, NULL, szTime, 15);
	strcat(szDateTime, " ");
	strcat(szDateTime, szTime);
	return szDateTime;
}

LPSTR FormatDWordHex(DWORD dwValue, LPSTR lpszValue, DWORD dwMaxDigits = 4)
{
	char szTemp[50];

	_ultoa(dwValue, szTemp, 16);
	int nAdd = dwMaxDigits - strlen(szTemp);
	if (nAdd > 0)
	{
		memset(lpszValue, '0', nAdd);
		lpszValue[nAdd] = '\0';
	}
	else
		lpszValue[0] = '\0';

	strcat(lpszValue, szTemp);
	sprintf(szTemp, "0x%s", lpszValue);
	strcpy(lpszValue, szTemp);

	return lpszValue;
}

LPSTR FormatDWord(DWORD dwValue, LPSTR lpszValue, LPSTR lpszMore = NULL)
{
	char szTemp[30];
	NUMBERFMT nf;

	nf.NumDigits = 0;
	nf.LeadingZero = 0;
	nf.Grouping = 3;
	nf.lpDecimalSep = ".";
	nf.lpThousandSep = ",";
	nf.NegativeOrder = 0;

	_ultoa(dwValue, szTemp, 10);
	GetNumberFormat(LOCALE_USER_DEFAULT, 0, szTemp, &nf, lpszValue, LINE_BUFFER_SIZE);
	if (lpszMore != NULL)
		strcat(lpszValue, lpszMore);

	return lpszValue;
}


LPSTR GetFileType(DWORD dwFileType, LPSTR lpszFileType)
{
	const int  NumOfTypes = 7;
	KEY_VALUE FilesTypes[NumOfTypes] = {
		{ VFT_UNKNOWN, "Unknown" },
		{ VFT_APP, "Application" },
		{ VFT_DLL, "Dynamic-Link Library" },
		{ VFT_DRV, "Device Driver" },
		{ VFT_FONT, "Font" },
		{ VFT_VXD, "Virtual Device" },
		{ VFT_STATIC_LIB, "Static-Link Library" } };

	return KeyValueToStr(FilesTypes, NumOfTypes, dwFileType, lpszFileType);
}

LPSTR GetExeType(DWORD dwExeType, LPSTR lpszExeType)
{
	const int NumOfTypes = 7;
	KEY_VALUE ExeTypes[NumOfTypes] = {
		{ EXE_TYPE_UNKNOWN, "Unknown" },
		{ EXE_TYPE_DOS, "MS-DOS" },
		{ EXE_TYPE_NE, "New Executable (16-bit)" },
		{ EXE_TYPE_PE, "Portable Executable (x86 or x86-64 see \"Portable Executable Header Information)\"" },
		{ EXE_TYPE_LE, "Linear Executable (Virtual Device Driver)" },
		{ EXE_TYPE_LX, "Linear Executable: OS/2 2.x " },
		{ EXE_TYPE_W3, "Windows WIN386.EXE file" } };

	return KeyValueToStr(ExeTypes, NumOfTypes, dwExeType, lpszExeType);
}


int ShowExeInfo(LPCSTR lpszFilename)
{
	DWORD dwTemp;
	UINT dwSize;
	HANDLE hFile;
	char szValue[LINE_BUFFER_SIZE], szTemp[LINE_BUFFER_SIZE];


	//Open file
	if ((hFile = OpenFileForRead(lpszFilename)) != INVALID_HANDLE_VALUE)
	{
		char szMZHeader[MZHEADER_SIZE];
		char szMewHeader[NEWHEADER_SIZE];

		DWORD dwRead, dwExeType, dwNewHeaderLoc;
		BOOL bResult;

		//Read MZ header. (MS-DOS Header)
		bResult = ReadFile(hFile, szMZHeader, MZHEADER_SIZE, &dwRead, NULL);
		if (bResult && dwRead == MZHEADER_SIZE)
		{
			cout << "Filename: " << lpszFilename << endl;
			if (szMZHeader[0] == 'M' && szMZHeader[1] == 'Z')
			{
				IMAGE_DOS_HEADER *idh;
				idh = (IMAGE_DOS_HEADER *)szMZHeader;

				if (szMZHeader[0x18] != 0x40)
					dwExeType = EXE_TYPE_DOS;
				else
				{
					dwNewHeaderLoc = idh->e_lfanew;
					SetFilePointer(hFile, dwNewHeaderLoc, NULL, FILE_BEGIN);

					//Read next header. (PE, NE, or LE)
					bResult = ReadFile(hFile, szMewHeader, NEWHEADER_SIZE, &dwRead, NULL);
					if (bResult && dwRead >= 255)
					{
						if (szMewHeader[0] == 'P' && szMewHeader[1] == 'E')
							dwExeType = EXE_TYPE_PE;
						else if (szMewHeader[0] == 'N' && szMewHeader[1] == 'E')
							dwExeType = EXE_TYPE_NE;
						else if (szMewHeader[0] == 'L' && szMewHeader[1] == 'E')
							dwExeType = EXE_TYPE_LE;
					}
					else
						dwExeType = EXE_TYPE_UNKNOWN;

				}

				DWORD dwFileSize = GetFileSize(hFile, NULL);
				FormatDWord(dwFileSize, szValue);
				strcat(szValue, szBytesWord);
				cout <<"File Size: " << szValue << endl;

				FILETIME ftCreation, ftModified;
				GetFileTime(hFile, &ftCreation, NULL, &ftModified);
				cout << "Created Date: " << FormatFileTime(ftCreation, szValue) << endl;
				cout << "Modified Date: " << FormatFileTime(ftModified, szValue) << endl;
				cout << "Executable Format: " << GetExeType(dwExeType, szValue) << endl;

				cout << "\r\nMS-DOS Header Information\r\n=========================\r\n";
				cout << "Bytes in the last page: " << FormatDWord(idh->e_cblp, szValue) << endl;
				cout << "Number of pages: " << FormatDWord(idh->e_cp, szValue) << endl;
				cout << "Relocation entries: " << FormatDWord(idh->e_crlc, szValue) << endl;
				cout << "Header size in paragraphs: " << FormatDWord(idh->e_cparhdr, szValue) << endl;
				cout << "Initial SS (Relative): " << FormatDWordHex(idh->e_ss, szValue) << endl;
				cout << "Initial SP: " << FormatDWordHex(idh->e_sp, szValue) << endl;
				cout << "Initial CS (Relative): " << FormatDWordHex(idh->e_cs, szValue) << endl;
				cout << "Initial IP: " << FormatDWordHex(idh->e_ip, szValue) << endl;
				cout << "Checksum: " << FormatDWordHex(idh->e_csum, szValue) << endl;;
				if (GetDosCompress(szMZHeader, szTemp))
				{
					sprintf(szValue, "\r\n*** The file is compressed with %s ***\r\n", szTemp);
					cout << szValue;
				}

				if (dwExeType == EXE_TYPE_NE)
				{
					IMAGE_OS2_HEADER *iosh = (IMAGE_OS2_HEADER *)szMewHeader;
					cout <<"\r\nNew Executable Header Information\r\n===================================\r\n";
					cout << "Version Number: " << itoa(iosh->ne_ver, szValue, 10) << endl;
					cout << "Revision Number: " << itoa(iosh->ne_rev, szValue, 10) << endl;
					cout << "Entry Table Offset: " << FormatDWordHex(iosh->ne_enttab, szValue) << endl;
					cout << "Entry Table Size: " << FormatDWord(iosh->ne_cbenttab, szValue, szBytesWord) << endl;
					cout << "Checksum: " << FormatDWordHex(iosh->ne_crc, szValue, 8) << endl;
					cout << "Library Module: " << ((iosh->ne_flags & 0x8000) ? "Yes" : "No") << endl;
					cout << "Target OS: " << GetNETargetOS(iosh->ne_exetyp, szValue) << endl;

					cout << "Initial Heap Allocation: " << FormatDWord(iosh->ne_heap, szValue, szBytesWord) << endl;
					cout << "Initial Stack Allocation: " << FormatDWord(iosh->ne_heap, szValue, szBytesWord) << endl;
					sprintf(szValue, "%.4x:%.4x", (WORD)(((DWORD)iosh->ne_csip) >> 16), (WORD)(((DWORD)iosh->ne_csip) & 0xffff));
					cout << "Initial CS:IP: " << szValue << endl;

					sprintf(szValue, "%.4x:%.4x", (WORD)(((DWORD)iosh->ne_sssp) >> 16), (WORD)(((DWORD)iosh->ne_sssp) & 0xffff));
					cout << "Initial SS:SP: " << szValue << endl;

					cout << "Segment Entries: " << FormatDWord(iosh->ne_cseg, szValue) << endl;
					cout << "Module Entries: " << FormatDWord(iosh->ne_cmod, szValue) << endl;
					cout << "Non-Resident Name Table: " << FormatDWord(iosh->ne_cbnrestab, szValue, szBytesWord) << endl;

					cout << "Segment Table Offset: " << FormatDWordHex(iosh->ne_segtab, szValue) << endl;
					cout << "Resource Table Offset: " << FormatDWordHex(iosh->ne_rsrctab, szValue) << endl;
					cout << "Resident Names Offset: " << FormatDWordHex(iosh->ne_restab, szValue) << endl;
					cout << "Module Reference Offset: " << FormatDWordHex(iosh->ne_modtab, szValue) << endl;
					cout << "Imported Names Offset: " << FormatDWordHex(iosh->ne_imptab, szValue) << endl;
					cout << "Non-resident Names Offset: " << FormatDWordHex(iosh->ne_nrestab, szValue, 8) << endl;

					cout << "Movable Entries Count: " << FormatDWord(iosh->ne_cmovent, szValue) << endl;
					cout << "Segment Alignment: " << FormatDWord(iosh->ne_align, szValue) << endl;
					cout << "Resource Segments Count: " << FormatDWord(iosh->ne_cres, szValue) << endl;



				}


				if (dwExeType == EXE_TYPE_PE)
				{
					IMAGE_FILE_HEADER *ifh;

					cout << "\r\nPortable Executable Header Information\r\n===================================\r\n";
					ifh = (IMAGE_FILE_HEADER *)&szMewHeader[4];
					/*check if app for windows x86_64 then set machine_64 as true*/
					if (ifh->Machine == IMAGE_FILE_MACHINE_AMD64)
					{
						machine_64 = true;
					}
					else
					{
						machine_64 = false;
					}
					cout << "Machine: " << GetMachineName(ifh->Machine, szValue) << endl;
					cout << "Number Of Sections: " << FormatDWord(ifh->NumberOfSections, szValue) << endl;
					cout << "Number Of Symbols: " << FormatDWord(ifh->NumberOfSymbols, szValue) << endl;
					cout << "Optional Header Size: " << FormatDWord(ifh->SizeOfOptionalHeader, szValue, szBytesWord) << endl;
					cout << "Time Stamp: " << FormatDWordHex(ifh->TimeDateStamp, szValue) << endl;
					if (machine_64)
						cout << "Characteristics: " << GetCharacteristics(ifh->Characteristics, szValue) << endl << " * 64 bit word machine" << endl;
					else
						cout << "Characteristics: " << GetCharacteristics(ifh->Characteristics, szValue) << endl;

					cout <<"\r\nOptional Header Information\r\n===================================\r\n";

					IMAGE_OPTIONAL_HEADER32 *ioh = (IMAGE_OPTIONAL_HEADER32 *)&szMewHeader[24];
					sprintf(szValue, "%d.%d", ioh->MajorLinkerVersion, ioh->MinorLinkerVersion);
					cout << "Linker Version: " << szValue << endl;
					cout << "Size Of Code: " << FormatDWord(ioh->SizeOfCode, szValue, szBytesWord) << endl;
					cout << "Size of initialized data: " << FormatDWord(ioh->SizeOfInitializedData, szValue, szBytesWord) << endl;
					cout << "Size of uninitialized data: " << FormatDWord(ioh->SizeOfUninitializedData, szValue, szBytesWord) << endl;

					if (ifh->Machine == IMAGE_FILE_MACHINE_I386 && ifh->SizeOfOptionalHeader >= 224)
					{
						cout << "Section Alignment: " << FormatDWord(ioh->SectionAlignment, szValue, szBytesWord) << endl;
						cout << "File Alignment: " << FormatDWord(ioh->FileAlignment, szValue, szBytesWord) << endl;
						sprintf(szValue, "%d.%d", ioh->MajorOperatingSystemVersion, ioh->MinorOperatingSystemVersion);
						cout << "OS Version: " << szValue << endl;
						sprintf(szValue, "%d.%d", ioh->MajorImageVersion, ioh->MinorImageVersion);
						cout << "Image Version: " << szValue << endl;
						sprintf(szValue, "%d.%d", ioh->MajorSubsystemVersion, ioh->MinorSubsystemVersion);
						cout << "Subsystem Version: " << szValue << endl;
						cout << "Size Of Image: " << FormatDWord(ioh->SizeOfImage, szValue, szBytesWord) << endl;
						cout << "Size Of Headers: " << FormatDWord(ioh->SizeOfHeaders, szValue, szBytesWord) << endl;
						cout << "Checksum: " << FormatDWordHex(ioh->CheckSum, szValue, 8) << endl;
						cout << "Subsystem: " << GetSubsystemName(ioh->Subsystem, szValue) << endl;
						cout << "Reserve Stack Size: " << FormatDWordHex(ioh->SizeOfStackReserve, szValue, 8) << endl;
						cout << "Commit Stack Size: " << FormatDWordHex(ioh->SizeOfStackCommit, szValue, 8) << endl;
						cout << "Reserve Heap Size: " << FormatDWordHex(ioh->SizeOfHeapReserve, szValue, 8) << endl;
						cout << "Commit Heap Size: " << FormatDWordHex(ioh->SizeOfHeapCommit, szValue, 8) << endl;
						cout << "Base Address: " << FormatDWordHex(ioh->ImageBase, szValue, 8) << endl;

					}
					cout << "Entry Point: " << FormatDWordHex(ioh->AddressOfEntryPoint, szValue, 8) << endl;
					cout << "Base Of Code: " << FormatDWordHex(ioh->BaseOfCode, szValue, 8) << endl;
					cout << "Base Of Data: " << FormatDWordHex(ioh->BaseOfData, szValue, 8) << endl;

					//Section Headers
					IMAGE_SECTION_HEADER *ishs;
					DWORD dwInfo1;
					USHORT uNumOfSections = ifh->NumberOfSections;
					if (uNumOfSections > MAX_NUM_OF_SECTIONS)
						uNumOfSections = MAX_NUM_OF_SECTIONS;

					ishs = (IMAGE_SECTION_HEADER *)&szMewHeader[24 + ifh->SizeOfOptionalHeader];

					cout <<"\r\nSection Headers Information\r\n===================================\r\n";
					sprintf(szValue, "This file has %d sections:\r\n", ifh->NumberOfSections);
					cout << szValue << endl;
					for (USHORT uIndex = 0; uIndex < uNumOfSections; uIndex++)
					{
						if (uIndex == 0)
							cout << "----------------------------------------\r\n";
						memcpy(szValue, ishs[uIndex].Name, 8);
						szValue[8] = '\0';
						cout << "Section Name: " << szValue << endl;
						cout << "Virtual Address: " << FormatDWordHex(ishs[uIndex].VirtualAddress, szValue, 8) << endl;
						cout << "Raw Data Size: " << FormatDWordHex(ishs[uIndex].SizeOfRawData, szValue, 8) << endl;
						cout << "Raw Data Pointer: " << FormatDWordHex(ishs[uIndex].PointerToRawData, szValue, 8) << endl;
						cout << "Characteristics: " << GetSectionCharacteristics(ishs[uIndex].Characteristics, szValue) << endl;

						cout << "----------------------------------------\r\n";
					}

					GetInfoFromSectionHeaders(ishs, uNumOfSections, &dwInfo1);
					if ((dwInfo1 & SECTIONS_HEADER_INFO_PKLITE) != 0)
						cout <<"\r\n*** The file is compressed with PKLITE for Windows ***\r\n";

					if ((dwInfo1 & SECTIONS_HEADER_INFO_WINZIP) != 0)
						cout <<"\r\n*** The file is self-extractor archive created by WinZip ***\r\n";

					if ((dwInfo1 & SECTIONS_HEADER_INFO_WWPACK32) != 0)
						cout <<"\r\n*** The file is compressed with WWPACK32 ***\r\n";

					if ((dwInfo1 & SECTIONS_HEADER_INFO_UPX) != 0)
						cout <<"\r\n*** The file is compressed with UPX ***\r\n";

					//Compilers Detection
					char *pVBSignature = (char *)&szMewHeader[24 + ifh->SizeOfOptionalHeader + 40 * uNumOfSections + 0x10];
					char *pDelphiSignature = (char *)&szMewHeader[0x400 - idh->e_lfanew];

					BYTE VBVer = 0;
					char szCompiler[30] = "";
					//Visual Basic Detection
					if (memcmp(pVBSignature, SIGNATURE_VB4, strlen(SIGNATURE_VB4)) == 0) VBVer = 4;
					if (memcmp(pVBSignature, SIGNATURE_VB5, strlen(SIGNATURE_VB5)) == 0) VBVer = 5;
					if (memcmp(pVBSignature, SIGNATURE_VB6, strlen(SIGNATURE_VB6)) == 0) VBVer = 6;
					if (VBVer != 0)
						sprintf(szCompiler, "Visual Basic %d.0", VBVer);
					else
						//Delphi Detection
					if (memcmp(pDelphiSignature, SIGNATURE_DELPHI_1, 13) == 0 ||
						memcmp(pDelphiSignature, SIGNATURE_DELPHI_2, 13) == 0 ||
						memcmp(pDelphiSignature, SIGNATURE_DELPHI_3, 11) == 0)
						strcpy(szCompiler, "Borland Delphi");

					if (szCompiler[0] != '\0')
					{
						sprintf(szValue, "\r\n*** The file was compiled by %s ***\r\n", szCompiler);
						cout << szValue;
					}

				}

			}
			else
			{
				cout << "\r\nUnrecognized file format.\r\n";
				return 2;
			}

		}
		else
		{
			cout << "Cannot read from " << lpszFilename << endl << "Error " << GetLastError() << endl;
			return 3;
		}

	}
	else
	{

		cout << "Cannot open " << lpszFilename << endl << "Error " << GetLastError() << endl;;
		return 4;
	}

	cout <<"\r\nVersion Information\r\n====================\r\n";
	dwSize = GetFileVersionInfoSize((LPTSTR)lpszFilename, &dwTemp);
	if (dwSize > 0)
	{
		char *buf = new char[dwSize];
		char *str;
		char szLang1[20];
		VS_FIXEDFILEINFO *pInfo;

		GetFileVersionInfo((LPTSTR)lpszFilename, 0, dwSize, buf);
		if (VerQueryValue((LPVOID)buf, "\\", (LPVOID *)&pInfo, &dwSize))
		{
			/*if machine_64 true then add to OS version x86_64*/
			if (machine_64)
			{
				cout << "Operating System: " << GetFileOSName(pInfo->dwFileOS, szValue) << " x86-64" << endl;
			}
			else
			{
				cout << "Operating System: " << GetFileOSName(pInfo->dwFileOS, szValue) << endl;
			}
			cout << "File Type: " << GetFileType(pInfo->dwFileType, szValue) << endl;
			cout << "File Sub-Type: " << GetFileSubType(pInfo->dwFileType, pInfo->dwFileSubtype, szValue) << endl;

			sprintf(szValue, "%d,%d,%d,%d", (pInfo->dwFileVersionMS >> 16), (pInfo->dwFileVersionMS & 65535), (pInfo->dwFileVersionLS >> 16), pInfo->dwFileVersionLS & 65535);
			cout << "File Version: " << szValue << endl;

			sprintf(szValue, "%d,%d,%d,%d", (pInfo->dwProductVersionMS >> 16), (pInfo->dwProductVersionMS & 65535), (pInfo->dwProductVersionLS >> 16), pInfo->dwProductVersionLS & 65535);
			cout << "Product Version: " << szValue << endl;

		}
		cout <<"============================================================\r\n";
		VerQueryValue((LPVOID)buf, "\\VarFileInfo\\Translation", (LPVOID *)&str, &dwSize);
		sprintf(szLang1, "%4.4X%4.4X", *(unsigned short *)str, *(unsigned short *)(str + 2));
		/* convert  szLang1 and szValue to Unicode, and print them as unicode*/
		wchar_t szLang1w[20];
		wchar_t szValuew[LINE_BUFFER_SIZE];
		mbstowcs(szLang1w, szLang1, 20);
		if (GetInfoStr(buf, szLang1w, L"ProductName", szValuew))
			wcout << L"Product Name: " << szValuew << endl;
		if (GetInfoStr(buf, szLang1w, L"FileDescription", szValuew))
			wcout << L"File Description: " << szValuew << endl;
		if (GetInfoStr(buf, szLang1w, L"FileVersion", szValuew))
			wcout << L"File Version: " << szValuew << endl;
		if (GetInfoStr(buf, szLang1w, L"ProductVersion", szValuew))
			wcout << L"Product Version: " << szValuew << endl;
		if (GetInfoStr(buf, szLang1w, L"CompanyName", szValuew))
			wcout << L"Company Name: " << szValuew << endl;
		if (GetInfoStr(buf, szLang1w, L"InternalName", szValuew))
			wcout << L"Internal Name: " << szValuew << endl;;
		if (GetInfoStr(buf, szLang1w, L"LegalCopyright", szValuew))
			wcout << L"Legal Copyright: " << szValuew << endl;
		if (GetInfoStr(buf, szLang1w, L"OriginalFileName", szValuew))
			wcout << "Original FileName: " << szValuew << endl;
		/*********************************************/
		delete[]buf;
	}
	else
		cout << "Version information is not available for this file.\n\r";
	return 0;
}

int _tmain(int argc, char* argv[])
{
	char* szFilename;
	/*Set locales and charsets*/
	setlocale(LC_ALL, "");
	SetConsoleCP(CP_UTF8);
	SetConsoleOutputCP(CP_UTF8);

	/*check parametrs*/
	if (argc == 2)
	{
		szFilename = argv[1];
		/*run func for get info*/
		return ShowExeInfo(szFilename);
		 
	}
	else
	{
		cout << "usage: exeinfo.exe \"disk:\\path to app\\appname.exe\"" << endl;
		return 1;
	}
}