windwos 判断文件架构

CAir2

已于 2024-01-23 15:44:18 修改

阅读量419

点赞数 8

分类专栏： C++ 随笔文章标签： exe dll 架构 PE

于 2024-01-15 17:48:44 首次发布

本文链接：https://blog.csdn.net/CAir2/article/details/135607247

版权

C++ 随笔专栏收录该内容

77 篇文章 0 订阅

订阅专栏

原理：通过文件头来判断文件类型和架构和 DOS下exe头文件解析

下面直接上代码：

//0x0001-dll 0x0002-exe 
//0x0010-x32 0x0020-x64
bool get_file_arch(const char* szdllexe, int &ft)
{
    ft = 0;
    FILE* fp = fopen(szdllexe,"r+b");
    if (fp == nullptr) return false;

#define RT_RES(res)\
{fclose(fp); return res;}

    IMAGE_DOS_HEADER dosHeader = {0};
    size_t iread = fread(&dosHeader, 1, sizeof(dosHeader), fp);
    if (iread != sizeof(dosHeader)) RT_RES(false);
    //MZ file is exe or dll
    if (dosHeader.e_magic != IMAGE_DOS_SIGNATURE) RT_RES(false);
    //read PE header
    fseek(fp, dosHeader.e_lfanew + 4, SEEK_SET);

    IMAGE_FILE_HEADER imgHeader = { 0 };
    iread = fread(&imgHeader, 1, sizeof(imgHeader), fp);
    if (iread != sizeof(imgHeader)) RT_RES(false);

   	if (imgHeader.Characteristics & IMAGE_FILE_DLL) ft |= 0x0001;
	else if (imgHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE) ft |= 0x0002;

    if (imgHeader.Characteristics & IMAGE_FILE_32BIT_MACHINE) ft |= 0x0010;
    else ft |= 0x0020;
   
    RT_RES(true);
}