Pascal Executable ParserTop

A collection of classes and functions to parse executable files for the Pascal language, namely for Free Pascal and Delphi. Everything is implemented in Pascal, there are no external dependencies.

These are my findings trying to parse these files. Not everything is implemented yet (e.g. Resource parsing), and I may be wrong here and there. If you have improvements let me know.

LicenseTop

BSD

Supported filesTop

Actually it also has support for 16 Bit DOS COM files, because these do not have a special format, they can be loaded with the TPseRawFile class.

CompatibilityTop

OS
Windows, Linux
Compiler
Delphi, Free Pascal (Generics required)

UsageTop

// Register files we need
TPseFile.RegisterFile(TPsePeFile);
TPseFile.RegisterFile(TPseElfFile);
TPseFile.RegisterFile(TPseNeFile);
// If its not one of the above load it as raw file
TPseFile.RegisterFile(TPseRawFile);

// filename contains the name of the executable
PseFile := TPseFile.GetInstance(filename, false);
try
  WriteLn(PseFile.GetFriendlyName);
  WriteLn(Format('Entry point 0x%x', [PseFile.GetEntryPoint]));

  WriteLn(Format('%d Sections', [PseFile.Sections.Count]));
  for i := 0 to PseFile.Sections.Count - 1 do begin
    sec := PseFile.Sections[i];
    WriteLn(Format('%s: Address 0x%x, Size %d', [sec.Name, sec.Address, sec.Size]));
  end;

  WriteLn(Format('%d Imports', [PseFile.ImportTable.Count]));
  for i := 0 to PseFile.ImportTable.Count - 1 do begin
    imp := PseFile.ImportTable[i];
    WriteLn(Format('%s:', [imp.DllName]));
    for j := 0 to imp.Count - 1 do begin
      api := imp[j];
      WriteLn(Format('  %s: Hint %d, Address: 0x%x', [api.Name, api.Hint, api.Address]));
    end;
  end;

  WriteLn(Format('%d Exports', [PseFile.ExportTable.Count]));
  for i := 0 to PseFile.ExportTable.Count - 1 do begin
    expo := PseFile.ExportTable[i];
    WriteLn(Format('  %s: Orinal %d, Address: 0x%x', [expo.Name, expo.Ordinal, expo.Address]));
  end;

  if PseFile is TPsePeFile then begin
    // PE specific code...
  end else if PseFile is TPseElfFile then begin
    // ELF specific code...
  end;

finally
  PseFile.Free;
end;

For details see pse.dpr.

DownloadTop

ScreenshotTop

The output of the test program for a 32-Bit DLL file:

PESP

Unlike Capstone, I tested this on a more recent version of Debian (8) with Lazarus 1.2.4 and Free Pascal 2.6.4:

PESP on Debian

ReferencesTop