-- Rich Signature Displayer -- © 2008 Daniel Pistelli filename = GetOpenFile() if filename == null then return end hFile = OpenFile(filename) if hFile == null then return end nSignDwords = 0 for i = 0, 100 do dw = ReadDword(hFile, 0x80 + (i * 4)) if dw == null then return end -- is this the "Rich" terminator? if dw == 0x68636952 then nSignDwords = i break end end if nSignDwords == 0 then return end -- read xor mask mask = ReadDword(hFile, 0x80 + ((nSignDwords + 1) * 4)) -- init string strInfo = "VC++ tools used:\r\n" -- decrypt versions for i = 4, nSignDwords - 1, 2 do dw = ReadDword(hFile, 0x80 + (i * 4)) ^ mask id = dw >> 16 minver = dw & 0xFFFF vnum = ReadDword(hFile, 0x80 + ((i + 1) * 4)) ^ mask strInfo = strInfo .. "\r\n" .. "Id: " .. id .. " Version: " .. minver .. " Times: " .. vnum end -- show versions MsgBox(strInfo, "Rich Signature Info", MB_ICONINFORMATION)