zoukankan
html css js c++ java
检查一个文件是不是可执行文件(Win32 PE)
Code
Option
Explicit
Private
Declare
Sub
CopyMemory Lib
"
kernel32
"
Alias
"
RtlMoveMemory
"
(Destination
As
Any, Source
As
Any, ByVal Length
As
Long
)
Private
Declare
Function
CreateFile Lib
"
kernel32
"
Alias
"
CreateFileA
"
(ByVal lpFileName
As
String
, ByVal dwDesiredAccess
As
Long
, ByVal dwShareMode
As
Long
, lpSecurityAttributes
As
Any, ByVal dwCreationDisposition
As
Long
, ByVal dwFlagsAndAttributes
As
Long
, ByVal hTemplateFile
As
Long
)
As
Long
Private
Declare
Function
GetFileSize Lib
"
kernel32
"
(ByVal hFile
As
Long
, lpFileSizeHigh
As
Long
)
As
Long
Private
Declare
Function
ReadFile Lib
"
kernel32
"
(ByVal hFile
As
Long
, lpBuffer
As
Any, ByVal nNumberOfBytesToRead
As
Long
, lpNumberOfBytesRead
As
Long
, lpOverlapped
As
Any)
As
Long
Private
Declare
Function
SetFilePointer Lib
"
kernel32
"
(ByVal hFile
As
Long
, ByVal lDistanceToMove
As
Long
, lpDistanceToMoveHigh
As
Long
, ByVal dwMoveMethod
As
Long
)
As
Long
Private
Declare
Function
CloseHandle Lib
"
kernel32
"
(ByVal hObject
As
Long
)
As
Long
'
DOS .EXE头部
Private
Type IMAGE_DOS_HEADER
e_magic
As
Integer
'
魔术字
e_cblp
As
Integer
'
文件最后页的字节数
e_cp
As
Integer
'
文件页数
e_crlc
As
Integer
'
重定义元素个数
e_cparhdr
As
Integer
'
头部尺寸,以段落为单位
e_minalloc
As
Integer
'
所需的最小附加段
e_maxalloc
As
Integer
'
所需的最大附加段
e_ss
As
Integer
'
初始的SS值(相对偏移量)
e_sp
As
Integer
'
初始的SP值
e_csum
As
Integer
'
校验和
e_ip
As
Integer
'
初始的IP值
e_cs
As
Integer
'
初始的CS值(相对偏移量)
e_lfarlc
As
Integer
'
重分配表文件地址
e_ovno
As
Integer
'
覆盖号
e_res(
0
To
3
)
As
Integer
'
保留字
e_oemid
As
Integer
'
OEM标识符(相对e_oeminfo)
e_oeminfo
As
Integer
'
OEM信息
e_res2(
0
To
9
)
As
Integer
'
保留字
e_lfanew
As
Long
'
新exe头部的文件地址
End
Type
Private
Const
GENERIC_READ
=
&
H80000000
Private
Const
FILE_SHARE_READ
=
&
H1
Private
Const
OPEN_EXISTING
As
Long
=
3
Private
Const
FILE_BEGIN
=
0
Private
Const
FILE_CURRENT
=
1
'
函数:检查一个文件是不是可执行文件(Win32 PE)
'
如果是Win32 PE文件,返回 True,否则返回 False
Public
Function
CheckPEFile(ByVal strFileName
As
String
)
As
Boolean
On
Error
Resume
Next
Dim
hFile
As
Long
Dim
lngApiRet
As
Long
Dim
lngRet
As
Long
Dim
ReadBuf(
4
)
As
Byte
hFile
=
CreateFile(strFileName, ByVal (GENERIC_READ
Or
FILE_SHARE_READ),
0
, ByVal
0
, OPEN_EXISTING,
0
, ByVal
0
)
If
hFile
>
0
Then
Dim
PEDosHeader
As
IMAGE_DOS_HEADER
lngApiRet
=
ReadFile(hFile, PEDosHeader, ByVal
Len
(PEDosHeader), lngRet, ByVal
0
)
If
lngApiRet
>
0
And
lngRet
=
64
Then
'
因为有些人喜欢鼓捣些很小的PE文件,那么这里改成:
'
If GetFileSize(hFile, 0) < 68 Then
If
GetFileSize(hFile,
0
)
<
424
Then
'
其实不止吧 呵呵
CloseHandle hFile
Exit
Function
End
If
CopyMemory ReadBuf(
0
), PEDosHeader.e_magic,
2
If
(
Chr
(ReadBuf(
0
))
&
Chr
(ReadBuf(
1
))
=
"
MZ
"
)
Then
lngApiRet
=
SetFilePointer(hFile, PEDosHeader.e_lfanew,
0
, FILE_BEGIN)
If
lngApiRet
>
0
Then
lngApiRet
=
ReadFile(hFile, ReadBuf(
0
),
4
, lngRet, ByVal
0
)
If
lngApiRet
>
0
And
lngRet
=
4
Then
If
(
Chr
(ReadBuf(
0
))
&
Chr
(ReadBuf(
1
))
=
"
PE
"
)
And
(ReadBuf(
2
)
=
0
)
And
(ReadBuf(
3
)
=
0
)
Then
CheckPEFile
=
True
CloseHandle hFile
Exit
Function
End
If
End
If
End
If
End
If
End
If
CloseHandle hFile
End
If
End Function
查看全文
相关阅读:
linux 安装jdk
linux 安装 Redis
jvisualvm监控远程jvm的两种连接方式
list转map(JDK8-Lambda表达式)
循环删除list中的某一元素的三种方式
SpringBoot-@ControllerAdvice 拦截异常并统一处理
Spring-@ControllerAdvice 拦截异常并统一处理
Tomcat系列
thinkPHP5.1模型User设计
uniapp后台api设计(微信user表)
原文地址:https://www.cnblogs.com/sysdzw/p/1243785.html
最新文章
为什么的力量
学习动力与拖延
design mode(php)
trait
类(class)相关概念小结
Oauth
Oracle查询如何才能行转列?-sunziren
Jstree在加载时和加载完成的回调方法-sunziren
amr格式转mp3和直接播放amr格式的文件-sunziren
9个常用的正则表达式-sunziren
热门文章
如何将下载的Jar包导入本地Maven仓库-sunziren
首次使用Lambda表达式-sunziren
Maven国内镜像配置(阿里云)-sunziren
IE浏览器中IFrame被加载两次问题的解决-sunziren
解决树莓派鼠标延迟/迟滞问题-转CSDN博主“Deiki”-sunziren
SpringBoot项目自定义浏览器选项卡左上角图标(favicon.ico)-sunziren
ES集群调整搜索速度
常见统计模型
linux安装mysql5.7
linux安装nginx
Copyright © 2011-2022 走看看