Notes: Analyzing Delphi
Function | Description |
---|---|
InitExe | Read resource drm in .rsrc, call StartExe to InitRoutineTable to read all functions (FunctionTable), and execute Routine. |
CreateForm | Create the Form, initialize the main function of Delphi, the second parameter edx points to the pointer of the TCustomForm virtual function table, construct the main form of the program _cls_Forms_TCustomForm |
Run | Generally, AddExitProc adds the form destructor to the exit function execution flow. The following is the HandleMessage message loop. |
Halt0 | When dwReasin is 0, call ExitProcess to end |
Copy-Pasted from: https://www.programmersought.com/article/36625698711/
Tools: IDR (https://github.com/crypto2011/IDR)