#include <ButtonConstants.au3>
#include <EditConstants.au3>
#include <GUIConstantsEx.au3>
#include <StaticConstants.au3>
#include <WindowsConstants.au3>
#include <Constants.au3>
#include <String.au3>
#Region ### START Koda GUI section ### Form=C:\Users\Redclaw\Desktop\Stuff\Progging\PE Stuff\PE-Compare.kxf
$Form1 = GUICreate("PE-Compare", 626, 534, 192, 124)
GUISetBkColor(0xA0A0A0)
$Button1 = GUICtrlCreateButton("Load", 8, 16, 57, 33, $WS_GROUP)
$Input1 = GUICtrlCreateInput("", 72, 21, 449, 21)
GUICtrlSetState(-1, $GUI_DISABLE)
$Label1 = GUICtrlCreateLabel("Nothing Loaded", 528, 24, 80, 17)
GUICtrlSetBkColor(-1, 0xFFFF00)
$Edit1 = GUICtrlCreateEdit("", 8, 112, 305, 361, BitOR($ES_AUTOVSCROLL,$ES_AUTOHSCROLL,$ES_WANTRETURN,$WS_VSCROLL))
$Edit2 = GUICtrlCreateEdit("", 315, 111, 305, 361, BitOR($ES_AUTOVSCROLL,$ES_AUTOHSCROLL,$ES_WANTRETURN,$WS_VSCROLL))
$Button2 = GUICtrlCreateButton("Load", 8, 57, 57, 33, $WS_GROUP)
$Input2 = GUICtrlCreateInput("", 72, 64, 449, 21)
GUICtrlSetState(-1, $GUI_DISABLE)
$Label2 = GUICtrlCreateLabel("Nothing Loaded", 528, 65, 80, 17)
GUICtrlSetBkColor(-1, 0xFFFF00)
$Button3 = GUICtrlCreateButton("Save", 102, 483, 57, 33, $WS_GROUP)
$Button4 = GUICtrlCreateButton("Save", 446, 483, 57, 33, $WS_GROUP)
GUISetState(@SW_SHOW)
#EndRegion ### END Koda GUI section ###

;var section
Global $ep = "",$NoS = "",$Fal = "", $Sal = "",$ImgS = "",$ImgBase= "",$t = "",$pos = "",$PEstart,$F1 = "" , $F2 = ""
Global $ImgSizePos = 0,$EpPos = 0
Global $secname[100]
Global $secvsize[100]
Global $secvadd[100]
Global $secrawdat[100]
Global $secprawdat[100]
Global $secflag[100]
Global $sechead[100]
Global $secnr[100]
Global $i = 0,$j = 0
;var section

While 1
	$nMsg = GUIGetMsg()
	Switch $nMsg
		Case $GUI_EVENT_CLOSE
			Exit
		Case $Button1
			$path = FileOpenDialog("Choose .exe File",@ScriptDir,"PE Files (*.exe)")
			$f1 = Fileopen($path,16)
			if not @error then _updlog("File Loaded"& @crlf & "---------------------------------")
			If _chkexe($f1) = 1 Then
				Guictrlsetdata($Input1,$path)
				GUICtrlSetData($Label1,"OK")
				GUICtrlSetBkColor($Label1, 0x00FF00)
			Else
				GUICtrlSetData($Label1,"ERROR")
				GUICtrlSetBkColor($Label1, 0xFF0000)
			ENDIF
			_peanalysis($f1)
			_secanalysis($f1)
		Case $Button2
			$path2 = FileOpenDialog("Choose .exe File",@ScriptDir,"PE Files (*.exe)")
			$f2 = Fileopen($path2,16)
			if not @error then _updlog2("File Loaded"& @crlf & "---------------------------------")
			If _chkexe2($f2) = 1 Then
				Guictrlsetdata($Input2,$path2)
				GUICtrlSetData($Label2,"OK")
				GUICtrlSetBkColor($Label2, 0x00FF00)
			Else
				GUICtrlSetData($Label2,"ERROR")
				GUICtrlSetBkColor($Label2, 0xFF0000)
			ENDIF
			_peanalysis2($f2)
			_secanalysis2($f2)
			Case $Button3
			FileWrite(Fileopen(StringTrimRight(FileSaveDialog("Save Log",@ScriptDir,"Textfile (*.txt)"),4) & ".txt",2),GUICtrlRead($Edit1))
			Case $Button4
			FileWrite(Fileopen(StringTrimRight(FileSaveDialog("Save Log",@ScriptDir,"Textfile (*.txt)"),4) & ".txt",2),GUICtrlRead($Edit2))

	EndSwitch
WEnd

func _revbyt($bytes,$c)
local $out = "", $t = ""
$bytes = _StringReverse($bytes)
For $i=0 to $c -2  Step 2
	$t =  _StringReverse(StringMid($bytes,$i+1,2))
	$out = $out & $t
Next
return $out
endfunc


Func _getdec($num)
	return dec(StringReplace($num,"0x",""))
endfunc

Func _updlog($data)
local $prev = ""
$prev = GUICtrlRead($Edit1)
GUICtrlSetData($Edit1,$prev & @CRLF & $data)
endfunc

Func _updlog2($data)
local $prev = ""
$prev = GUICtrlRead($Edit2)
GUICtrlSetData($Edit2,$prev & @CRLF & $data)
endfunc

Func _chkexe($hnd)
Filesetpos($hnd,0,0)
If FileRead($hnd,2) = "0x4D5A" Then
_updlog("0x4D5A MZ Bytes Found")
Filesetpos($hnd,60,0)
$PEstart = _revbyt(Fileread($hnd,2),4)
Filesetpos($hnd,_getdec($PEstart),0)
_updlog("PE Header Location found :  " & $PEstart)
If FileRead($hnd,4) = "0x50450000" Then
	_updlog("0x50450000 PE Bytes Found" & @crlf )
	_updlog("PE-File Verification Successfull"& @crlf & "---------------------------------")
		Return 1
	else
		Return -1
		_updlog("PE-File Verification Failed"& @crlf & "---------------------------------"& @crlf)
		Fileclose($hnd)
	EndIf
EndIf
Endfunc

Func _chkexe2($hnd)
Filesetpos($hnd,0,0)
If FileRead($hnd,2) = "0x4D5A" Then
_updlog2("0x4D5A MZ Bytes Found")
Filesetpos($hnd,60,0)
$PEstart = _revbyt(Fileread($hnd,2),4)
Filesetpos($hnd,_getdec($PEstart),0)
_updlog2("PE Header Location found :  " & $PEstart)
If FileRead($hnd,4) = "0x50450000" Then
	_updlog2("0x50450000 PE Bytes Found" & @crlf )
	_updlog2("PE-File Verification Successfull"& @crlf & "---------------------------------")
		Return 1
	else
		Return -1
		_updlog2("PE-File Verification Failed"& @crlf & "---------------------------------"& @crlf)
		Fileclose($hnd)
	EndIf
EndIf
Endfunc

Func _peanalysis2($hnd)
_updlog2("Anylsis of PE and Optional Header" & @CRLF)
Filesetpos($hnd,2,1)
$NoS = _revbyt(Fileread($hnd,2),4)
_updlog2("Number of Sections : " & $NoS & "h    " & _getdec($NoS))
Filesetpos($hnd,32,1)
$EpPos = Filegetpos($hnd)
$ep = _revbyt(Fileread($hnd,4),8)
_updlog2("Entry Point : " & $ep & "h    " & _getdec($ep))
Filesetpos($hnd,8,1)
$ImgBase = _revbyt(Fileread($hnd,4),8)
_updlog2("Image Base : " & $ImgBase & "h    " & _getdec($ImgBase))
$Sal = _revbyt(Fileread($hnd,4),8)
_updlog2("Section Alignment : " & $Sal & "h    " & _getdec($Sal))
$Fal = _revbyt(Fileread($hnd,4),8)
_updlog2("File Alignment : " & $Fal & "h    " & _getdec($Fal))
Filesetpos($hnd,16,1)
$ImgSizePos = Filegetpos($hnd)
$ImgS = _revbyt(Fileread($hnd,4),8)
_updlog2("Image Size : " & $ImgS & "h    " & _getdec($ImgS) & @CRLF)
_updlog2("PE-Analysis complete"& @crlf & "---------------------------------" & @CRLF )
endfunc


Func _peanalysis($hnd)
_updlog("Anylsis of PE and Optional Header" & @CRLF)
Filesetpos($hnd,2,1)
$NoS = _revbyt(Fileread($hnd,2),4)
_updlog("Number of Sections : " & $NoS & "h    " & _getdec($NoS))
Filesetpos($hnd,32,1)
$EpPos = Filegetpos($hnd)
$ep = _revbyt(Fileread($hnd,4),8)
_updlog("Entry Point : " & $ep & "h    " & _getdec($ep))
Filesetpos($hnd,8,1)
$ImgBase = _revbyt(Fileread($hnd,4),8)
_updlog("Image Base : " & $ImgBase & "h    " & _getdec($ImgBase))
$Sal = _revbyt(Fileread($hnd,4),8)
_updlog("Section Alignment : " & $Sal & "h    " & _getdec($Sal))
$Fal = _revbyt(Fileread($hnd,4),8)
_updlog("File Alignment : " & $Fal & "h    " & _getdec($Fal))
Filesetpos($hnd,16,1)
$ImgSizePos = Filegetpos($hnd)
$ImgS = _revbyt(Fileread($hnd,4),8)
_updlog("Image Size : " & $ImgS & "h    " & _getdec($ImgS) & @CRLF)
_updlog("PE-Analysis complete"& @crlf & "---------------------------------" & @CRLF )
endfunc

Func _secanalysis($hnd)
_updlog("Anylsis of Section Table" & @CRLF)
Filesetpos($hnd,164,1)
_updlog("Number of Sections : " & _getdec($NoS) & " therefore " & _getdec($NoS)*40 & " Bytes Section Table" & @crlf )
For $i=0 to _getdec($NoS)-1
	$sechead[$i] = Filegetpos($hnd)
	$secnr[$i] = $i
	$secname[$i] = _HexToString(FileRead($hnd,8))
	_updlog("Section  "& $i+1)
	_updlog("Name : " & $secname[$i])
	$secvsize[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog("Virtual Size : " & $secvsize[$i] & "h    " & _getdec($secvsize[$i]))
	$secvadd[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog("Virtual Address : " & $secvadd[$i] & "h    " & _getdec($secvadd[$i]))
	$secrawdat[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog("Size of RAW-Data : " & $secrawdat[$i] & "h    " & _getdec($secrawdat[$i]))
	$secprawdat[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog("Pointer to RAW-Data : " & $secprawdat[$i] & "h    " & _getdec($secprawdat[$i]))
	Filesetpos($hnd,12,1)
	$secflag[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog("Flag : " & $secflag[$i] & "h    " & _getdec($secflag[$i]) & @CRLF)
next
_updlog("Section Analysis Complete"& @crlf & "---------------------------------" & @CRLF)
endfunc

Func _secanalysis2($hnd)
_updlog2("Anylsis of Section Table" & @CRLF)
Filesetpos($hnd,164,1)
_updlog2("Number of Sections : " & _getdec($NoS) & " therefore " & _getdec($NoS)*40 & " Bytes Section Table" & @crlf )
For $i=0 to _getdec($NoS)-1
	$sechead[$i] = Filegetpos($hnd)
	$secnr[$i] = $i
	$secname[$i] = _HexToString(FileRead($hnd,8))
	_updlog2("Section  "& $i+1)
	_updlog2("Name : " & $secname[$i])
	$secvsize[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog2("Virtual Size : " & $secvsize[$i] & "h    " & _getdec($secvsize[$i]))
	$secvadd[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog2("Virtual Address : " & $secvadd[$i] & "h    " & _getdec($secvadd[$i]))
	$secrawdat[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog2("Size of RAW-Data : " & $secrawdat[$i] & "h    " & _getdec($secrawdat[$i]))
	$secprawdat[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog2("Pointer to RAW-Data : " & $secprawdat[$i] & "h    " & _getdec($secprawdat[$i]))
	Filesetpos($hnd,12,1)
	$secflag[$i] = _revbyt(FileRead($hnd,4),8)
	_updlog2("Flag : " & $secflag[$i] & "h    " & _getdec($secflag[$i]) & @CRLF)
next
_updlog2("Section Analysis Complete"& @crlf & "---------------------------------" & @CRLF)
endfunc