工程文件petype.cpp通过调用pefile类中的函数获取文件类型。
文件类型的判断通过5个监测点完成。
监测点1：dos头的e_magic
监测点2：nt头的Signature
监测点3：文件头的Characteristics
监测点4：可选头的Magic
监测点5：可选头的Subsystem
通过监测点1和2判断是否是pe文件；
通过监测点3判断文件是否是动态库文件
通过监测点4判断文件是pe32还是pe32+还是rom映像
通过监测点5判断文件是否是0环可执行文件[驱动文件]，还是3环可执行文件[exe文件]
具体代码参见下面：
pefile.h
#ifndef PE_FILE_H
#define PE_FILE_H
#include "windows.h" #define ISMZHEADER (*(WORD*)File_memory == 0x5a4d)
#define ISPEHEADER (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c)) == 0x4550)
#define ISPE32MAGIC (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x10b)
#define ISPE64MAGIC (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x20b)
#define ISPEROMMAGIC (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x107) #define X_PE_32 32
#define X_PE_64 64 #define READ_ERRO 0x0
#define NOT_PE_FILE 0x200
#define PE_FILE 0x100
#define PE64_FILE 0x40
#define PE32_FILE 0x20
#define ROM_IMAGE 0x10
#define EXE_FILE 0x8
#define DLL_FILE 0x4
#define SYS_FILE 0x2
#define OTHER_FILE 0x1 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
#define X_EXPORT 0
#define X_IMPORT 1
#define X_RESOURSE 2
#define X_EXCEPTION 3
#define X_CERTIFICATE 4
#define X_BASE_RELOCATION 5
#define X_DEBUG 6
#define X_ARCHITECTURE 7
#define X_GLOBAL_PTR 8
#define X_TLS 9
#define X_LOAD_CONFIG 10
#define X_BAND_IMPORT 11
#define X_IAT 12
#define X_DELAY_IMPORT 13
#define X_COM_HEADER 14
#define X_RESERVED 15 typedef struct X_IMAGE_DOS_HEADER { // DOS .EXE header
WORD e_magic; // Magic number
WORD e_cblp; // Bytes on last page of file
WORD e_cp; // Pages in file
WORD e_crlc; // Relocations
WORD e_cparhdr; // Size of header in paragraphs
WORD e_minalloc; // Minimum extra paragraphs needed
WORD e_maxalloc; // Maximum extra paragraphs needed
WORD e_ss; // Initial (relative) SS value
WORD e_sp; // Initial SP value
WORD e_csum; // Checksum
WORD e_ip; // Initial IP value
WORD e_cs; // Initial (relative) CS value
WORD e_lfarlc; // File address of relocation table
WORD e_ovno; // Overlay number
WORD e_res[]; // Reserved words
WORD e_oemid; // OEM identifier (for e_oeminfo)
WORD e_oeminfo; // OEM information; e_oemid specific
WORD e_res2[]; // Reserved words
LONG e_lfanew; // File address of new exe header
} MX_IMAGE_DOS_HEADER; typedef struct X_IMAGE_FILE_HEADER {
WORD Machine;
WORD NumberOfSections;
DWORD TimeDateStamp;
DWORD PointerToSymbolTable;
DWORD NumberOfSymbols;
WORD SizeOfOptionalHeader;
WORD Characteristics;
} MX_IMAGE_FILE_HEADER; typedef struct X_IMAGE_DATA_DIRECTORY {
DWORD VirtualAddress;
DWORD Size;
} MX_IMAGE_DATA_DIRECTORY; typedef struct X_IMAGE_OPTIONAL_HEADER32 {
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
MX_IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} MX_IMAGE_OPTIONAL_HEADER32; typedef struct X_IMAGE_OPTIONAL_HEADER64 {
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
ULONGLONG ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
ULONGLONG SizeOfStackReserve;
ULONGLONG SizeOfStackCommit;
ULONGLONG SizeOfHeapReserve;
ULONGLONG SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} MX_IMAGE_OPTIONAL_HEADER64; typedef struct X_IMAGE_NT_HEADERS32 {
DWORD Signature;
MX_IMAGE_FILE_HEADER FileHeader;
MX_IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} MX_IMAGE_NT_HEADERS32; typedef struct X_IMAGE_NT_HEADERS64 {
DWORD Signature;
MX_IMAGE_FILE_HEADER FileHeader;
MX_IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} MX_IMAGE_NT_HEADERS64; class XPEFILE
{
public:
XPEFILE(char* lpFileName);
virtual ~XPEFILE();
int GetType();
int GetSize();
private:
void* File_memory;
int File_size;
int File_type;
}; #endif
pefile.h
pefile.cpp
#include "stdafx.h"
#include "windows.h"
#include "pefile.h"
#include <iostream> XPEFILE::XPEFILE(char* strFileName)
{
HANDLE hfile;
unsigned long sizehigh;
void* lpmemory; File_memory = NULL;
File_type = READ_ERRO; hfile = CreateFile(strFileName, GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,,OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN,);
if (hfile != INVALID_HANDLE_VALUE)
{
File_size = GetFileSize(hfile, NULL);
lpmemory = LocalAlloc(LPTR,File_size);
if(ReadFile(hfile,lpmemory,File_size,&sizehigh,) != NULL)
{
File_memory = lpmemory;
}
CloseHandle(hfile);
}
} XPEFILE::~XPEFILE()
{
if (File_memory == NULL)
{
LocalFree(File_memory);
}
} int XPEFILE::GetSize()
{
return File_size;
} int XPEFILE::GetType()
{
MX_IMAGE_NT_HEADERS32* ntheader32;
MX_IMAGE_NT_HEADERS64* ntheader64; File_type = READ_ERRO; if (File_memory == NULL)
{
return File_type;
}
File_type = NOT_PE_FILE;
// if ((*(WORD*)File_memory == 0x5a4d) && (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c)) == 0x4550))
if(ISMZHEADER && ISPEHEADER)
{
File_type = PE_FILE;
}
if (File_type == PE_FILE)
{
// if (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x10b)
if (ISPE32MAGIC)
{
File_type = File_type | PE32_FILE;
ntheader32 = (MX_IMAGE_NT_HEADERS32*) ((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c));
if (ntheader32->FileHeader.Characteristics & 0x2000)
{
File_type = File_type | DLL_FILE;
}
else if ((ntheader32->OptionalHeader.Subsystem & )|(ntheader32->OptionalHeader.Subsystem & ))
{
File_type = File_type | EXE_FILE;
}
else if (ntheader32->OptionalHeader.Subsystem & )
{
File_type = File_type | SYS_FILE;
}
}
// if (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x20b)
if (ISPE64MAGIC)
{
File_type = File_type | PE64_FILE;
ntheader64 = (MX_IMAGE_NT_HEADERS64*) ((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c));
if (ntheader64->FileHeader.Characteristics & 0x2000)
{
File_type = File_type | DLL_FILE;
}
else if ((ntheader64->OptionalHeader.Subsystem & )|(ntheader64->OptionalHeader.Subsystem & ))
{
File_type = File_type | EXE_FILE;
}
else if (ntheader64->OptionalHeader.Subsystem & )
{
File_type = File_type | SYS_FILE;
}
}
// if (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x107)
if (ISPEROMMAGIC)
{
File_type = File_type | ROM_IMAGE;
}
}
return File_type;
}
pefile.cpp
petype.cpp
#include "stdafx.h"
#include "pefile.h"
#include <iostream> int main(int argc, char* argv[])
{
int filetype; char* file = "c:\\1.exe";
XPEFILE pefile1(file); filetype = pefile1.GetType(); system("pause");
return ;
}
petype.cpp