title: Read strings from .exe files(Like Strings.exe) in Delphi
body: <p>I want to write a program for read/extract all of the valid strings in a .exe files (For example: "This program must be run under Win" or "MZ"), Exactly like <code>Strings.exe</code> of <code>sysinternals</code>.
  Actually i want to scan a <code>.exe</code> file and if that contain special string value such as <code>"ekrn.exe"</code> or <code>"Filrefox.exe"</code> then detect that file as a suspicious file (Killing <code>ekrn.exe</code> or inject malcode to <code>firefox.exe</code>).</p>
  
  <p>I wrote the following code in Delphi :</p>
  
  <pre><code>const
    TargetName = 'E:\AntiDebugg.exe';
  var
    hFile: THandle;
    tmp: AnsiString;
    dwFileSize, lChar, lSearch: Integer;
    dwNumRead: Cardinal;
    dwBuffer: array of AnsiChar;
  begin
    mmo1.Clear;
  
    hFile := CreateFileA(TargetName, GENERIC_READ, FILE_SHARE_READ, nil,
      OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  
    dwFileSize := GetFileSize(hFile, nil);
    SetLength(dwBuffer, dwFileSize);
  
    lChar := 0;
    lSearch := 0;
  
    while lChar &lt;= dwFileSize do
    begin
      ReadFile(hFile, dwBuffer[lChar], SizeOf(dwBuffer), dwNumRead, nil);
      while dwBuffer[lChar] &lt;&gt; '' do
      begin
        tmp := tmp + dwBuffer[lChar];
        Inc(lChar, 1);
      end;
      lSearch := 0;
      Inc(lChar, 1);
    end;
    mmo1.Text := (tmp);
    CloseHandle(hFile);
  </code></pre>
  
  <p>The result of running my code is  (A small piece):</p>
  
  <pre><code>MZPےے¸@؛´   ح!¸Lح!گگThis program must be run under Win32
  $7PEL
  %0فQà´أ\
  ¤"0Bگب.textd­ .itext| .data`@.bssطN.idata\
  @.didataب@.tls.rdata@.reloc¤"@.rsrc@@@Boolean@alseTrueSystem4@AnsiCharP@    Charےh@Integerے€@Byteک@Wordے°@Pointerؤ@Cardinalےےےà@    NativeIntےےےü@
  NativeUIntے@ShortStringے,@  PAnsiChar0@D@stringT@TClassŒ@h@HRESULTے€@TGUID
  </code></pre>
  
  <p>But this isn't my desired result and my desired result is :</p>
  
  <pre><code>MZP
  This program must be run under Win32
  .text
  `.itext
  `.data
  .bss
  .idata
  .didata
  .tls
  .rdata
  @.reloc
  B.rsrc
  Boolean
  False
  True
  System
  AnsiChar
  Char
  Integer
  Byte
  Word
  Pointer
  Cardinal
  NativeInt
  NativeUInt
  ShortString
  PAnsiChar0
  string
  TClass
  HRESULT
  TGUID
  </code></pre>
  
  <ul>
  <li>In this example the <code>AntiDebugg.exe</code> compiled by Delphi .</li>
  </ul>
  
  <p>The result of <code>Strings.exe</code> for strings of "AntiDebugg.exe"</p>
  
  <p><img src="https://i.stack.imgur.com/I4GpU.png" alt="enter image description here"></p>
  
  <p>Any idea ?
  What should i to do ?</p>