滴水三期逆向基础系列(番外)-判断PE文件是否为64位

BOOL is64Bit = is64BitOS(FilePath_In);

BOOL is64BitOS(
	IN LPSTR lpszFile
){
	LPVOID pDemoBuffer = NULL;
	ReadPEFile(lpszFile, &pDemoBuffer);

	PIMAGE_DOS_HEADER idh = NULL;
	PIMAGE_NT_HEADERS inh = NULL;

	idh = (PIMAGE_DOS_HEADER)pDemoBuffer;
	inh = (PIMAGE_NT_HEADERS)((BYTE *)pDemoBuffer + idh->e_lfanew);
	cout << hex << "机器码为:" << inh->FileHeader.Machine << endl;
	if(inh->Signature != IMAGE_NT_SIGNATURE){
		cout << "PE文件版本可能为64位" << endl;
		return FALSE;
	}
	
	if (inh->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 || inh->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64){
		cout << "PE文件版本为64位" << endl;
		return TRUE;
	}else{
		cout << "PE文件版本为32位" << endl;
		return FALSE;
	}
}
DWORD ReadPEFile(
	IN LPSTR lpszFile, 
	OUT LPVOID *pFileBuffer
){
	FILE *pFile = NULL;
	DWORD fileSize = 0;
	LPVOID pTempFileBuffer = NULL;

	pFile = fopen(lpszFile, "rb");
	if(!pFile){
		printf("fopen打开EXE文件失败...");
		return ERROR;
	}
	fseek(pFile, 0, SEEK_END);
	fileSize = ftell(pFile);
	fseek(pFile, 0, SEEK_SET);

	pTempFileBuffer = malloc(fileSize);
	memset(pTempFileBuffer,0x00,fileSize);
	if(!pTempFileBuffer){
		printf("pTempFileBuffer空间申请失败...");
		fclose(pFile);
		return ERROR;
	}
	size_t n = fread(pTempFileBuffer, fileSize, 1, pFile);
	if(!n){
		printf("fread数据读取失败...");
		free(pTempFileBuffer);
		fclose(pFile);
		return ERROR;
	}
	*pFileBuffer = pTempFileBuffer;
	pTempFileBuffer = NULL;
	fclose(pFile);
	return fileSize;
}

这个就没什么可说的了，看着开头是MZ，偏移时，该出现PE时没出现，就可能是32位，但是检测到machine的数值，就能确定位数。