zoukankan
html css js c++ java
检查一个文件是不是可执行文件(Win32 PE)
Code
Option
Explicit
Private
Declare
Sub
CopyMemory Lib
"
kernel32
"
Alias
"
RtlMoveMemory
"
(Destination
As
Any, Source
As
Any, ByVal Length
As
Long
)
Private
Declare
Function
CreateFile Lib
"
kernel32
"
Alias
"
CreateFileA
"
(ByVal lpFileName
As
String
, ByVal dwDesiredAccess
As
Long
, ByVal dwShareMode
As
Long
, lpSecurityAttributes
As
Any, ByVal dwCreationDisposition
As
Long
, ByVal dwFlagsAndAttributes
As
Long
, ByVal hTemplateFile
As
Long
)
As
Long
Private
Declare
Function
GetFileSize Lib
"
kernel32
"
(ByVal hFile
As
Long
, lpFileSizeHigh
As
Long
)
As
Long
Private
Declare
Function
ReadFile Lib
"
kernel32
"
(ByVal hFile
As
Long
, lpBuffer
As
Any, ByVal nNumberOfBytesToRead
As
Long
, lpNumberOfBytesRead
As
Long
, lpOverlapped
As
Any)
As
Long
Private
Declare
Function
SetFilePointer Lib
"
kernel32
"
(ByVal hFile
As
Long
, ByVal lDistanceToMove
As
Long
, lpDistanceToMoveHigh
As
Long
, ByVal dwMoveMethod
As
Long
)
As
Long
Private
Declare
Function
CloseHandle Lib
"
kernel32
"
(ByVal hObject
As
Long
)
As
Long
'
DOS .EXE头部
Private
Type IMAGE_DOS_HEADER
e_magic
As
Integer
'
魔术字
e_cblp
As
Integer
'
文件最后页的字节数
e_cp
As
Integer
'
文件页数
e_crlc
As
Integer
'
重定义元素个数
e_cparhdr
As
Integer
'
头部尺寸,以段落为单位
e_minalloc
As
Integer
'
所需的最小附加段
e_maxalloc
As
Integer
'
所需的最大附加段
e_ss
As
Integer
'
初始的SS值(相对偏移量)
e_sp
As
Integer
'
初始的SP值
e_csum
As
Integer
'
校验和
e_ip
As
Integer
'
初始的IP值
e_cs
As
Integer
'
初始的CS值(相对偏移量)
e_lfarlc
As
Integer
'
重分配表文件地址
e_ovno
As
Integer
'
覆盖号
e_res(
0
To
3
)
As
Integer
'
保留字
e_oemid
As
Integer
'
OEM标识符(相对e_oeminfo)
e_oeminfo
As
Integer
'
OEM信息
e_res2(
0
To
9
)
As
Integer
'
保留字
e_lfanew
As
Long
'
新exe头部的文件地址
End
Type
Private
Const
GENERIC_READ
=
&
H80000000
Private
Const
FILE_SHARE_READ
=
&
H1
Private
Const
OPEN_EXISTING
As
Long
=
3
Private
Const
FILE_BEGIN
=
0
Private
Const
FILE_CURRENT
=
1
'
函数:检查一个文件是不是可执行文件(Win32 PE)
'
如果是Win32 PE文件,返回 True,否则返回 False
Public
Function
CheckPEFile(ByVal strFileName
As
String
)
As
Boolean
On
Error
Resume
Next
Dim
hFile
As
Long
Dim
lngApiRet
As
Long
Dim
lngRet
As
Long
Dim
ReadBuf(
4
)
As
Byte
hFile
=
CreateFile(strFileName, ByVal (GENERIC_READ
Or
FILE_SHARE_READ),
0
, ByVal
0
, OPEN_EXISTING,
0
, ByVal
0
)
If
hFile
>
0
Then
Dim
PEDosHeader
As
IMAGE_DOS_HEADER
lngApiRet
=
ReadFile(hFile, PEDosHeader, ByVal
Len
(PEDosHeader), lngRet, ByVal
0
)
If
lngApiRet
>
0
And
lngRet
=
64
Then
'
因为有些人喜欢鼓捣些很小的PE文件,那么这里改成:
'
If GetFileSize(hFile, 0) < 68 Then
If
GetFileSize(hFile,
0
)
<
424
Then
'
其实不止吧 呵呵
CloseHandle hFile
Exit
Function
End
If
CopyMemory ReadBuf(
0
), PEDosHeader.e_magic,
2
If
(
Chr
(ReadBuf(
0
))
&
Chr
(ReadBuf(
1
))
=
"
MZ
"
)
Then
lngApiRet
=
SetFilePointer(hFile, PEDosHeader.e_lfanew,
0
, FILE_BEGIN)
If
lngApiRet
>
0
Then
lngApiRet
=
ReadFile(hFile, ReadBuf(
0
),
4
, lngRet, ByVal
0
)
If
lngApiRet
>
0
And
lngRet
=
4
Then
If
(
Chr
(ReadBuf(
0
))
&
Chr
(ReadBuf(
1
))
=
"
PE
"
)
And
(ReadBuf(
2
)
=
0
)
And
(ReadBuf(
3
)
=
0
)
Then
CheckPEFile
=
True
CloseHandle hFile
Exit
Function
End
If
End
If
End
If
End
If
End
If
CloseHandle hFile
End
If
End Function
查看全文
相关阅读:
appium连接真机时,报错:error: device unauthorized.
python使用163邮箱发送测试报告遇到smtplib.SMTPAuthenticationError: (550, b'User has no permission')问题
logging日志重复打印问题
python实现text/html的get请求
python实现Post请求四种请求体
selenium异常类
unittest所有断言方法
windows下Jenkins+webdriver无法启动浏览器
python3+selenium3之 解决:'chromedriver' executable needs to be in PATH问题
python学习(6)--logging打印日志
原文地址:https://www.cnblogs.com/sysdzw/p/1243785.html
最新文章
为何我们会写超长的代码
结对编程对于塑造团队文化的思考
兴人类TDD培训札记
如何在Maven和Gradle中配置使用Groovy 2.4与Spock 1.0
解决Maven并行编译中出现打包错误问题的思路
Groovy/Spock 测试导论
由“软件需要设计”想到的
Openflow Plugin学习笔记3
String split方法与Guava Splitter用法区别
Linux基础命令
热门文章
3-用户注册---用户类创建和短信验证码的功能实现
Django---项目
2-项目配置
1-项目前期的介绍与准备
Django---cookie和session
Django---请求、响应
Django---路由、配置和静态文件简介
Django---框架简介和工程搭建
web应用程序简介
js基础
Copyright © 2011-2022 走看看