README

PeXplorer

PeXplorer is a PE (Portable Executable) file analyzer and editor for Windows, written in Delphi 6. It was developed between 2003 and 2006 as a tool for developers, reverse engineers, and system programmers who need to examine and modify the internal structure of Windows executables (.exe, .dll, .sys, etc.).

Historical note: This is an archival release of source code from 2003–2006. It was built with Borland Delphi 6 and targets Windows XP/2000 era systems.

Features

PE Analysis

• Full PE header display: DOS header, File header, Optional header fields
• Section enumeration and inspection
• Data Directory viewer
• Import table viewer
• Export table viewer
• RVA ↔ File Offset converter

PE Editing

• Edit all PE header fields (with automatic .bak backup before saving)
• Add new PE sections
• Delete existing sections
• Edit section header flags and attributes
• Edit Data Directory entries
• Recalculate PE checksum (ImageHlp)

Checksum Tools

• CRC-16, CRC-32, CRC-ARC (XModem, PKZIP variants)
• PE header checksum calculation and verification

Process Tools

• List all running processes and their loaded modules
• Dump process memory (full or partial)
• Set process priority (Idle, Normal, High, Realtime)
• Kill processes
• Load memory dumps directly into PeXplorer

Resource & Utility Tools

• Graphics resource extractor (GfxRip)
• Window/control object inspector (Object Control)
• Binary file comparison
• Shell context menu integration ("Load Into PeXplorer")
• Command-line file opening support
• Audio module player (BASSMOD integration — yes, it played music)

Architecture

The application is a Delphi 6 SDI application using the VCL (Visual Component Library). Each major feature lives in its own form/unit. The core PE manipulation is done via direct memory-mapped structures (packed record types matching the Windows PE format exactly) over TMemoryStream.

PeXplorer.dpr       ??? Main project file
Main.pas            ??? Central hub form
PeLib.pas           ??? PE structure definitions
PeFunctions.pas     ??? Core utility functions
ProcWiz.pas         ??? Process wizard (enumerate, dump, control)
CRC.pas             ??? CRC calculation engine
Imports.pas         ??? Import table viewer
Export.pas          ??? Export table viewer
SecEdit.pas         ??? Section header editor
AddSection.pas      ??? Add PE sections dialog
DirEdit.pas         ??? Data Directory editor
Directory.pas       ??? Directory viewer
RvanOffset.pas      ??? RVA/Offset calculator
ObjectControl.pas   ??? Window object inspector
CompareBF.pas       ??? Binary file comparison
GfxRip.pas          ??? Graphics resource extractor
Options.pas         ??? Settings/preferences
About.pas           ??? About dialog
bassmod_dynamic.pas ??? BASSMOD DLL dynamic wrapper

Building

Requirements:

• Borland Delphi 6 (or later Delphi versions may work with minor adjustments)
• Windows target (uses Windows API extensively)
• BASSMOD.dll (included) — required at runtime for audio features

Steps:

1. Open PeXplorer.dpr in Delphi 6
2. Build → Compile All
3. The output executable will be placed in the project directory

Test Corpus

The yoda's PE corpus/ directory contains a collection of exotic and non-standard PE files assembled by Sistemo (April 2003) for testing PE tools. It includes samples from:

• .NET — .NET / COM+ PE files
• Delphi — Delphi-compiled binaries with unusual features (TLS, reloc)
• PE32Plus (64bit!!) — 64-bit PE32+ files
• VB — Visual Basic compiled binaries
• Watcom Compiler — Watcom compiler outputs with non-standard PE layouts
• Root corpus files with merged sections, delay imports, no imports, optimized PE, etc.

Credit: yoda's 32-bit PE file test corpus by Sistemo (sistemo@gmx.net)

Known Limitations

From the original development notes (PeXNotes.txt):

• Loading live modules into PeXplorer causes an I/O Error 32 (file locked) — a temporary file system workaround was planned but not implemented
• Export tables that are not in sorted order (exotic PE files) may display values out of order
• Tab index navigation system was planned but not fully implemented

License

MIT License — see LICENSE