DLL prüfen

[Delbor]

Hi zusammen

Gibt es eine Möglichkeit, nicht nur die Dateiversion, sondern auch die Plattform (Win32, Win 64) einer DLL zu prüfen?

Gruss
Delbor

[DieDolly]

Vielleicht funktioniert das ja. Braucht aber JCL.

Delphi-Quellcode:

// Source:
// https://stackoverflow.com/questions/2748474/how-to-determine-if-dll-file-was-compiled-as-x64-or-x86-bit-using-either-delphi

function Isx64(const Strm: TStream): Boolean;
const
  IMAGE_FILE_MACHINE_I386     = $014c; // Intel x86
  IMAGE_FILE_MACHINE_IA64     = $0200; // Intel Itanium Processor Family (IPF)
  IMAGE_FILE_MACHINE_AMD64    = $8664; // x64 (AMD64 or EM64T)
  // You'll unlikely encounter the things below:
  IMAGE_FILE_MACHINE_R3000_BE = $160;  // MIPS big-endian
  IMAGE_FILE_MACHINE_R3000    = $162;  // MIPS little-endian, 0x160 big-endian
  IMAGE_FILE_MACHINE_R4000    = $166;  // MIPS little-endian
  IMAGE_FILE_MACHINE_R10000   = $168;  // MIPS little-endian
  IMAGE_FILE_MACHINE_ALPHA    = $184;  // Alpha_AXP }
  IMAGE_FILE_MACHINE_POWERPC  = $1F0;  // IBM PowerPC Little-Endian
var
  Header: TImageDosHeader;
  ImageNtHeaders: TImageNtHeaders;
begin
  Strm.ReadBuffer(Header, SizeOf(Header));
  if (Header.e_magic <> IMAGE_DOS_SIGNATURE) or
     (Header._lfanew = 0) then
    raise Exception.Create('Invalid executable');
  Strm.Position := Header._lfanew;

  Strm.ReadBuffer(ImageNtHeaders, SizeOf(ImageNtHeaders));
  if ImageNtHeaders.Signature <> IMAGE_NT_SIGNATURE then
    raise Exception.Create('Invalid executable');

  Result := ImageNtHeaders.FileHeader.Machine <> IMAGE_FILE_MACHINE_I386;
end;

[Delbor]

Hi DieDolly

Danke für deine prompte Antwort!!!
Das das so schnell geht, hätte ich mir jetzt echt nie träumen lassen!

Gruss
Delbor

[DieDolly]

Kann man die Funktion eventuell auch so verwenden?

Delphi-Quellcode:

 function Isx64(const FileName: string): Boolean;
 const
  IMAGE_FILE_MACHINE_I386 = $014C; // Intel x86
  IMAGE_FILE_MACHINE_IA64 = $0200; // Intel Itanium Processor Family (IPF)
  IMAGE_FILE_MACHINE_AMD64 = $8664; // x64 (AMD64 or EM64T)
  // You'll unlikely encounter the things below:
  IMAGE_FILE_MACHINE_R3000_BE = $160; // MIPS big-endian
  IMAGE_FILE_MACHINE_R3000 = $162; // MIPS little-endian, 0x160 big-endian
  IMAGE_FILE_MACHINE_R4000 = $166; // MIPS little-endian
  IMAGE_FILE_MACHINE_R10000 = $168; // MIPS little-endian
  IMAGE_FILE_MACHINE_ALPHA = $184; // Alpha_AXP }
  IMAGE_FILE_MACHINE_POWERPC = $1F0; // IBM PowerPC Little-Endian
 var
  Header: TImageDosHeader;
  ImageNtHeaders: TImageNtHeaders;
  MemoryStream: TMemoryStream;
 begin
  MemoryStream := TMemoryStream.Create;
  try
   MemoryStream.LoadFromFile(FileName);

   Strm.ReadBuffer(Header, SizeOf(Header));
   if (Header.e_magic <> IMAGE_DOS_SIGNATURE) or (Header._lfanew = 0) then
    raise Exception.Create('Invalid executable');
   Strm.Position := Header._lfanew;

   Strm.ReadBuffer(ImageNtHeaders, SizeOf(ImageNtHeaders));
   if ImageNtHeaders.Signature <> IMAGE_NT_SIGNATURE then
    raise Exception.Create('Invalid executable');
  finally
   MemoryStream.Free;
  end;

  Result := ImageNtHeaders.FileHeader.Machine <> IMAGE_FILE_MACHINE_I386;
 end;

[Delbor]

Hi DieDolly

Mit kleinen Änderungen wohl schon. Du hast teilweise vegessen, die Zuweisung an den übergebenen Stream 'Strm' durch Memorystream zu ersetzen.

Delphi-Quellcode:

 begin
  MemoryStream := TMemoryStream.Create;
  try
   MemoryStream.LoadFromFile(FileName);

   Strm.ReadBuffer(Header, SizeOf(Header));// Das hier müsste heissen:
   MemoryStream.ReadBuffer(Header, SizeOf(Header));
   if (Header.e_magic <> IMAGE_DOS_SIGNATURE) or (Header._lfanew = 0) then
    raise Exception.Create('Invalid executable');
   MemoryStream .Position := Header._lfanew;

   MemoryStream.ReadBuffer(ImageNtHeaders, SizeOf(ImageNtHeaders));
   if ImageNtHeaders.Signature <> IMAGE_NT_SIGNATURE then
    raise Exception.Create('Invalid executable');
  finally
   MemoryStream.Free;
  end;

Gruss
Delbor

[DieDolly]

Ups. Richtig. Stream hinzugefügt aber den alten nicht gelöscht :pale:

Hier nochmal alles richtig mit überladenen Prozeduren

Delphi-Quellcode:

function Isx64(const Strm: TStream): Boolean; overload;
const
 IMAGE_FILE_MACHINE_I386 = $014C; // Intel x86
 IMAGE_FILE_MACHINE_IA64 = $0200; // Intel Itanium Processor Family (IPF)
 IMAGE_FILE_MACHINE_AMD64 = $8664; // x64 (AMD64 or EM64T)
 // You'll unlikely encounter the things below:
 IMAGE_FILE_MACHINE_R3000_BE = $160; // MIPS big-endian
 IMAGE_FILE_MACHINE_R3000 = $162; // MIPS little-endian, 0x160 big-endian
 IMAGE_FILE_MACHINE_R4000 = $166; // MIPS little-endian
 IMAGE_FILE_MACHINE_R10000 = $168; // MIPS little-endian
 IMAGE_FILE_MACHINE_ALPHA = $184; // Alpha_AXP }
 IMAGE_FILE_MACHINE_POWERPC = $1F0; // IBM PowerPC Little-Endian
var
 Header: TImageDosHeader;
 ImageNtHeaders: TImageNtHeaders;
begin
 Strm.ReadBuffer(Header, SizeOf(Header));
 if (Header.e_magic <> IMAGE_DOS_SIGNATURE) or (Header._lfanew = 0) then
  raise Exception.Create('Invalid executable');
 Strm.Position := Header._lfanew;

 Strm.ReadBuffer(ImageNtHeaders, SizeOf(ImageNtHeaders));
 if ImageNtHeaders.Signature <> IMAGE_NT_SIGNATURE then
  raise Exception.Create('Invalid executable');

 Result := ImageNtHeaders.FileHeader.Machine <> IMAGE_FILE_MACHINE_I386;
end;

function Isx64(const FileName: string): Boolean; overload;
var
 MemoryStream: TMemoryStream;
begin
 MemoryStream := TMemoryStream.Create;
 try
  MemoryStream.LoadFromFile(FileName);
  Result := Isx64(MemoryStream);
 finally
  MemoryStream.Free;
 end;
end;

[Delbor]

Hi DieDolly

Nochmals vielen Dank!

Gruss
Delbor

[Andreas L.]

Delphi-Quellcode:

function Isx64(const Strm: TStream): Boolean; overload;
begin
  // Original Funktion
end;

function Isx64(AFileName: String): Boolean; overload;
var
  FileStream: TFileStream;
begin
  Result := False;
  if not SysUtils.FileExists(AFileName) then
    Exit;

  FileStream := TFileStream.Create(AFileName, fmOpenRead);
  try
    Result := Isx64(FileStream);
  finally
    FreeAndNil(FileStream);
  end;
end;

Das overload ist wichtig wenn die Namen der Routinen gleich sein sollen.