windows c++ 解析 SHD 文件

#include <Windows.h>
#include <string>

using namespace std;

typedef struct
{
    LARGE_INTEGER offDevMode;
    unsigned long dwPageCount;
    LARGE_INTEGER offUserName;
    HANDLE hFile;
    wstring PrintTaskUserName;
}DataInfo_t;

static DataInfo_t s_DataInfo;
typedef struct _tagSYSTEMTIME {
    unsigned short wYear;
    unsigned short wMonth;
    unsigned short wDayOfWeek;
    unsigned short wDay;
    unsigned short wHour;
    unsigned short wMinute;
    unsigned short wSecond;
    unsigned short wMilliseconds;
} SystemTime;


typedef struct __SHADOW_FILE_HEADER_WIN2000 {
    unsigned long dwSignature;        //SHD_SIGNATURE_WIN2000
    unsigned long dwHeaderSize;
    unsigned short wStatus;
    unsigned short wUnknown1;
    unsigned long dwJobID;
    unsigned long dwPriority;
    unsigned long offUserName;        //Offset of WideChar+0
    unsigned long offNotifyName;      //Offset of WideChar+0
    unsigned long offDocumentName;    //Offset of WideChar+0
    unsigned long offPort;            //Offset of WideChar+0
    unsigned long offPrinterName;     //Offset of WideChar+0
    unsigned long offDriverName;      //Offset of WideChar+0
    unsigned long offDevMode;         //Offset of DEVMODE
    unsigned long offPrintProcessor;  //Offset of WideChar+0
    unsigned long offDataFormat;      //Offset of WideChar+0
    unsigned long dwUnknown2;
    SystemTime stSubmitTime;
    unsigned long dwStartTime;
    unsigned long dwUntilTime;
    unsigned long dwSizeSPL;          //Size of SPL File
    unsigned long dwPageCount;
    unsigned long dwSizeSecurityInfo; //Size of SecurityInfo
    unsigned long offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR
    unsigned long dwUnknown3;
    unsigned long dwUnknown4;
    unsigned long dwUnknown5;
    unsigned long offComputername;    //Offset of WideChar+0
    unsigned long dwSPLSize2;
} SHADOW_FILE_HEADER_WIN2000, * PSHADOW_FILE_HEADER_WIN2000;

typedef struct __SHADOW_FILE_HEADER_WIN2000_64 {
    unsigned long dwSignature;        //SHD_SIGNATURE_WIN2000
    unsigned long dwHeaderSize;
    unsigned short wStatus;
    unsigned short wUnknown1;
    unsigned long dwJobID;

    ULONGLONG dwPriority;
    ULONGLONG offUserName;        //Offset of WideChar+0
    ULONGLONG offNotifyName;      //Offset of WideChar+0
    ULONGLONG offDocumentName;    //Offset of WideChar+0
    ULONGLONG offPort;            //Offset of WideChar+0
    ULONGLONG offPrinterName;     //Offset of WideChar+0
    ULONGLONG offDriverName;      //Offset of WideChar+0
    ULONGLONG offDevMode;         //Offset of DEVMODE
    ULONGLONG offPrintProcessor;  //Offset of WideChar+0
    ULONGLONG offDataFormat;      //Offset of WideChar+0
    ULONGLONG dwUnknown2;

    SystemTime stSubmitTime;
    unsigned long dwStartTime;
    unsigned long dwUntilTime;
    unsigned long dwSizeSPL;          //Size of SPL File
    unsigned long dwPageCount;
    unsigned long dwSizeSecurityInfo; //Size of SecurityInfo

    unsigned long offSecurityInfo;    //Offset of SECURITY_DESCRIPTOR
    unsigned long dwUnknown3;
    unsigned long dwUnknown4;
    unsigned long dwUnknown5;
    unsigned long offComputername;    //Offset of WideChar+0
    unsigned long dwSPLSize2;
} SHADOW_FILE_HEADER_WIN2000_64, * PSHADOW_FILE_HEADER_WIN2000_64;
BOOL IsWow64()
{
	SYSTEM_INFO SysInfo;
	GetNativeSystemInfo(&SysInfo);
	if (SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64 ||
		SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_IA64)
	{
		return TRUE;
	}
	return FALSE;
}
BOOL ParseShd_Head()
{
    BOOL bRet = IsWow64();
    DWORD nNumberOfBytesRead, nNumberOfBytesToRead;
    nNumberOfBytesToRead = bRet ? sizeof(SHADOW_FILE_HEADER_WIN2000_64) :
        sizeof(SHADOW_FILE_HEADER_WIN2000);
    if (bRet)
    {
        SHADOW_FILE_HEADER_WIN2000_64 Shadow;
        bRet = ReadFile(s_DataInfo.hFile, &Shadow, nNumberOfBytesToRead, &nNumberOfBytesRead, NULL);
        s_DataInfo.offDevMode.QuadPart = Shadow.offDevMode;
        s_DataInfo.dwPageCount = Shadow.dwPageCount;
        s_DataInfo.offUserName.QuadPart = Shadow.offUserName;
    }
    else
    {
        SHADOW_FILE_HEADER_WIN2000 Shadow;
        bRet = ReadFile(s_DataInfo.hFile, &Shadow, nNumberOfBytesToRead, &nNumberOfBytesRead, NULL);
        s_DataInfo.offDevMode.QuadPart = Shadow.offDevMode;
        s_DataInfo.dwPageCount = Shadow.dwPageCount;
        s_DataInfo.offUserName.QuadPart = Shadow.offUserName;
    }
    if (!bRet)
    {
        return FALSE;
    }
    
    return TRUE;
}
BOOL ParseShd_Data()
{
    if (!SetFilePointerEx(s_DataInfo.hFile, s_DataInfo.offDevMode, &s_DataInfo.offDevMode, FILE_BEGIN))
    {
        return FALSE;
    }
    DEVMODE Dev;
    DWORD nNumberOfBytesToRead,nUserNameLen;
    if (!ReadFile(s_DataInfo.hFile, &Dev, sizeof(Dev), &nNumberOfBytesToRead, NULL) || nNumberOfBytesToRead != sizeof(Dev))
    {
        return FALSE;
    }
    if (!SetFilePointerEx(s_DataInfo.hFile, s_DataInfo.offUserName, &s_DataInfo.offUserName, FILE_BEGIN))
    {
        return FALSE;
    }
    LARGE_INTEGER nFileSize = { 0 };
    GetFileSizeEx(s_DataInfo.hFile, &nFileSize);
    nUserNameLen = nFileSize.QuadPart - s_DataInfo.offUserName.QuadPart;
    s_DataInfo.PrintTaskUserName.resize(nUserNameLen, 0);
    if (!ReadFile(s_DataInfo.hFile, (wchar_t *)s_DataInfo.PrintTaskUserName.data(), nUserNameLen, &nNumberOfBytesToRead, NULL) || nNumberOfBytesToRead != nUserNameLen)
    {
        return FALSE;
    }
    return TRUE;
}
BOOL ParseShd(LPCTSTR lpFileName)
{
    s_DataInfo.hFile = CreateFile(lpFileName,
        GENERIC_READ,
        FILE_SHARE_READ,
        NULL,
        OPEN_EXISTING,
        0,
        NULL);
    if (!s_DataInfo.hFile || s_DataInfo.hFile == INVALID_HANDLE_VALUE)
    {
        return FALSE;
    }
    if (!ParseShd_Head())
    {
        return FALSE;
    }
    if (!ParseShd_Data())
    {
        return FALSE;
    }
    return TRUE;
}
int main(void)
{
	ParseShd(L"C:\\Windows\\System32\\spool\\PRINTERS\\00002.SHD");
	return 0;
}