zoukankan
html css js c++ java
检查一个文件是不是可执行文件(Win32 PE)
Code
Option
Explicit
Private
Declare
Sub
CopyMemory Lib
"
kernel32
"
Alias
"
RtlMoveMemory
"
(Destination
As
Any, Source
As
Any, ByVal Length
As
Long
)
Private
Declare
Function
CreateFile Lib
"
kernel32
"
Alias
"
CreateFileA
"
(ByVal lpFileName
As
String
, ByVal dwDesiredAccess
As
Long
, ByVal dwShareMode
As
Long
, lpSecurityAttributes
As
Any, ByVal dwCreationDisposition
As
Long
, ByVal dwFlagsAndAttributes
As
Long
, ByVal hTemplateFile
As
Long
)
As
Long
Private
Declare
Function
GetFileSize Lib
"
kernel32
"
(ByVal hFile
As
Long
, lpFileSizeHigh
As
Long
)
As
Long
Private
Declare
Function
ReadFile Lib
"
kernel32
"
(ByVal hFile
As
Long
, lpBuffer
As
Any, ByVal nNumberOfBytesToRead
As
Long
, lpNumberOfBytesRead
As
Long
, lpOverlapped
As
Any)
As
Long
Private
Declare
Function
SetFilePointer Lib
"
kernel32
"
(ByVal hFile
As
Long
, ByVal lDistanceToMove
As
Long
, lpDistanceToMoveHigh
As
Long
, ByVal dwMoveMethod
As
Long
)
As
Long
Private
Declare
Function
CloseHandle Lib
"
kernel32
"
(ByVal hObject
As
Long
)
As
Long
'
DOS .EXE头部
Private
Type IMAGE_DOS_HEADER
e_magic
As
Integer
'
魔术字
e_cblp
As
Integer
'
文件最后页的字节数
e_cp
As
Integer
'
文件页数
e_crlc
As
Integer
'
重定义元素个数
e_cparhdr
As
Integer
'
头部尺寸,以段落为单位
e_minalloc
As
Integer
'
所需的最小附加段
e_maxalloc
As
Integer
'
所需的最大附加段
e_ss
As
Integer
'
初始的SS值(相对偏移量)
e_sp
As
Integer
'
初始的SP值
e_csum
As
Integer
'
校验和
e_ip
As
Integer
'
初始的IP值
e_cs
As
Integer
'
初始的CS值(相对偏移量)
e_lfarlc
As
Integer
'
重分配表文件地址
e_ovno
As
Integer
'
覆盖号
e_res(
0
To
3
)
As
Integer
'
保留字
e_oemid
As
Integer
'
OEM标识符(相对e_oeminfo)
e_oeminfo
As
Integer
'
OEM信息
e_res2(
0
To
9
)
As
Integer
'
保留字
e_lfanew
As
Long
'
新exe头部的文件地址
End
Type
Private
Const
GENERIC_READ
=
&
H80000000
Private
Const
FILE_SHARE_READ
=
&
H1
Private
Const
OPEN_EXISTING
As
Long
=
3
Private
Const
FILE_BEGIN
=
0
Private
Const
FILE_CURRENT
=
1
'
函数:检查一个文件是不是可执行文件(Win32 PE)
'
如果是Win32 PE文件,返回 True,否则返回 False
Public
Function
CheckPEFile(ByVal strFileName
As
String
)
As
Boolean
On
Error
Resume
Next
Dim
hFile
As
Long
Dim
lngApiRet
As
Long
Dim
lngRet
As
Long
Dim
ReadBuf(
4
)
As
Byte
hFile
=
CreateFile(strFileName, ByVal (GENERIC_READ
Or
FILE_SHARE_READ),
0
, ByVal
0
, OPEN_EXISTING,
0
, ByVal
0
)
If
hFile
>
0
Then
Dim
PEDosHeader
As
IMAGE_DOS_HEADER
lngApiRet
=
ReadFile(hFile, PEDosHeader, ByVal
Len
(PEDosHeader), lngRet, ByVal
0
)
If
lngApiRet
>
0
And
lngRet
=
64
Then
'
因为有些人喜欢鼓捣些很小的PE文件,那么这里改成:
'
If GetFileSize(hFile, 0) < 68 Then
If
GetFileSize(hFile,
0
)
<
424
Then
'
其实不止吧 呵呵
CloseHandle hFile
Exit
Function
End
If
CopyMemory ReadBuf(
0
), PEDosHeader.e_magic,
2
If
(
Chr
(ReadBuf(
0
))
&
Chr
(ReadBuf(
1
))
=
"
MZ
"
)
Then
lngApiRet
=
SetFilePointer(hFile, PEDosHeader.e_lfanew,
0
, FILE_BEGIN)
If
lngApiRet
>
0
Then
lngApiRet
=
ReadFile(hFile, ReadBuf(
0
),
4
, lngRet, ByVal
0
)
If
lngApiRet
>
0
And
lngRet
=
4
Then
If
(
Chr
(ReadBuf(
0
))
&
Chr
(ReadBuf(
1
))
=
"
PE
"
)
And
(ReadBuf(
2
)
=
0
)
And
(ReadBuf(
3
)
=
0
)
Then
CheckPEFile
=
True
CloseHandle hFile
Exit
Function
End
If
End
If
End
If
End
If
End
If
CloseHandle hFile
End
If
End Function
查看全文
相关阅读:
数据挖掘、机器学习、人工智能学习笔记
SQL Server 定价及授权方式
数据仓库的架构以及数据分层【转】
java各历史版本官网下载
VMware三个版本workstation、server、esxi的区别
顶级项目孵化的故事系列——Kylin的心路历程【转】
Oracle数据库学习笔记
数据仓库学习笔记
多维数据库介绍【转】
ROLAP、MOLAP和HOLAP区别
原文地址:https://www.cnblogs.com/sysdzw/p/1243785.html
最新文章
191106
191105
windows下安装phpredis模块 (转)
OAuth的机制原理讲解及开发流程(转)
构建高性能web之路------mysql读写分离实战(转)
数据库的读写分离(转)
Redis和Memcache的区别分析(转)
公钥和私钥(转)
Magento EAV模型
Magento模块升级修改数据库表结构
热门文章
Magento模型与ORM基础
magento学习网址http://www.ruiwant.com/
MicroPython:基于TPYBoard集合MAX7219点阵模块制作表白女神神器
基于MicroPython结合ESP8266模块实现TCP通信(AT指令版)
毕业设计5:基于MicroPython的智能火灾报警器系统的设计与实现
毕业设计(4):基于MicroPython的超声波倒车雷达系统
毕业设计(2):基于MicroPython的家庭可燃气体泄露微信报警器
数据仓库事实表分类[转]
sqlserver2017 重装过程中出现“无法找到数据库引擎启动句柄”错误的解决办法
如何配置Java环境变量[转]
Copyright © 2011-2022 走看看