PE Viewer plugin

[speller2]

2 tbeu
Please download this file: http://wincmd.ru/files/peviewer_dbg.rar unpack peviewer.wlx into plugin dir replacing existing one and open a file with pe viewer. First time you will see the messagebox with message "hInstance: xxxxxxxx". Please write here the hInstance value and the address value in the Access Violation error message.

[damjang]

Both PEViewer 32 and 64bit give this AV on TC8. OS is Win7x64. Afterwards (clicking OK on the Error dialog) the plugin is correctly loaded.
Image: http://tbeu.de/forum/PEViewer.wlx64.png
Image: http://tbeu.de/forum/PEViewer.wlx.png

Same here with TC 8.0x32 winXPsp2x32

Please download this file: http://wincmd.ru/files/peviewer_dbg.rar unpack peviewer.wlx into plugin dir replacing existing one and open a file with pe viewer. First time you will see the messagebox with message "hInstance: xxxxxxxx". Please write here the hInstance value and the address value in the Access Violation error message.

hInstance:06470000
Access violation at address 06581460 in 'PEViewer.wlx'. Read of address 00000044.

[speller2]

ok, the problem is located, thank you.

[speller2]

New beta available: http://www.totalcmd.net/download.php?id=peviewer

[*] Fixed AV on plugin opening.
[*] Fixed sort direction on lists headers.
[*] Fixed lists sorting.

[speller2]

The new, and I hope the last beta is available: http://www.totalcmd.net/download.php?id=peviewer

[*] Fixed compiler determination bug.
[*] Improved working with correpted or compressed resources.
[*] Small GUI fixes.
[*] Added default file extension addition when saving resources.

[speller2]

And finally, release available: http://www.totalcmd.net/download.php?id=peviewer

[*] Fixed error when viewing 64-bit module under 32-bit Windows. Checked working under Win2000 SP4.

[ND]

I have just started using this plugin today, and I have discovered a problem...
It occurs when the file PEViewer.ini is read-only: when exiting Lister, the following message is triggered:

Title=PE Viewer
Icon=info
Text=SErrorClosingPlugin
Text=Unable to write to path\to\PEViewer.ini
Buttons=OK

This is not a problem in itself -- I can treat this as a warning (e.g. when working from read-only media, or restricted-access install-location, etc.).
The real problem occurs at opening Lister the next time, when following message is triggered:

Title=totalcmd
Icon=error
Text=System Error. Code: 1400.
Text=Invalid window handle.
Buttons=OK

This message is immediately re-triggered when closed, and it's not possible to access Lister or even TC afterwards => need to kill and re-start TC.

WinXP SP3, TC 8.0, PE Viewer 2.0 (all 32-bit).

[speller2]

Hi! Sorry for long silence! I have high load at my work so have no time for the development. Hope to obtain some time again )

[vfloyd]

Hi speller2,

Thank you for this plugin. I have a suggestion, maybe you could update it to display strings contained in the binary file previewed ?

[speller2]

2vfloyd
If anyone will provide me with an most useful algorythm to extract strings from binaries I will implement it sometime

[Dalai]

First of all, thank you very much for your nice PEViewer plugin. I use it almost every day!

It occurs when the file PEViewer.ini is read-only: when exiting Lister, the following message is triggered:

Title=PE Viewer
Icon=info
Text=SErrorClosingPlugin
Text=Unable to write to path\to\PEViewer.ini
Buttons=OK

This is not a problem in itself -- I can treat this as a warning (e.g. when working from read-only media, or restricted-access install-location, etc.).
The real problem occurs at opening Lister the next time, when following message is triggered:

Title=totalcmd
Icon=error
Text=System Error. Code: 1400.
Text=Invalid window handle.
Buttons=OK

This message is immediately re-triggered when closed, and it's not possible to access Lister or even TC afterwards => need to kill and re-start TC.

I can confirm this problem. Unfortunately, this bug makes it (alomost) impossible to use PEViewer on a read-only medium (BartPE, read-only network share etc). It would be really nice if this bug gets fixed. I also suggest to make an option to disable this warning message that the plugin can't write its settings file (it doesn't matter when I already know this, cause it's a read-only medium).

Additionally I found another bug in: see this screenshot. PEViewer shows a wrong date for TimeDateStamp in IMAGE_FILE_HEADER, even for its own plugin file. IIRC this applies to every PE file I checked.

And, lastly, another suggestion (or a wish since it's Christmas ): please don't use the registry to store the setting "Do not use lsplugin.ini". Instead you could just check for PEViewer.ini in the plugin's folder, which would make it much easier to use the plugin in a portable TC.

Regards
Dalai

[ZoSTeR]

2vfloyd
If anyone will provide me with an most useful algorythm to extract strings from binaries I will implement it sometime

Strings2 is based on the popular Sysinternals "strings".

[Matthias030]

Hi and thanks a lot for providing this plugin! After using plugin "FileInfo" for many years, this is my new default plugin for viewing details of executable files.

I had one problem: when using ini command "MainForm.Font.Size=10" (or 11) then the main menu is not shown correctly. The text "PE, Intel 386 (or compatible) is overlapping the menu item "settings v". This is only when using default (integrated) english language file. when using russian lng this problem is not there. Therefore I made new english language file based on the russian one. Now when using my own "english" lng file instead using the integrated one, the menu is shown fine.

I can provide my file if someone like.

Maybe provide also function to choose font?

Thanks and maybe you find the time for further development of this plugin

Matthias

[speller2]

Hi all.
Sorry for long time silence. I decided to release to plugin sources: https://github.com/speller/peviewer because I totally busy at my work and can't provide any support and development. It will be nice if someone will continue development of the plugin and make it better.
Thanks to all for using my plugin.

[byblo]

Thank you. Been using it since years