#include <Windows.h>
#include <string>
using namespace std;
typedef struct
{
LARGE_INTEGER offDevMode;
unsigned long dwPageCount;
LARGE_INTEGER offUserName;
HANDLE hFile;
wstring PrintTaskUserName;
}DataInfo_t;
static DataInfo_t s_DataInfo;
typedef struct _tagSYSTEMTIME {
unsigned short wYear;
unsigned short wMonth;
unsigned short wDayOfWeek;
unsigned short wDay;
unsigned short wHour;
unsigned short wMinute;
unsigned short wSecond;
unsigned short wMilliseconds;
} SystemTime;
typedef struct __SHADOW_FILE_HEADER_WIN2000 {
unsigned long dwSignature; //SHD_SIGNATURE_WIN2000
unsigned long dwHeaderSize;
unsigned short wStatus;
unsigned short wUnknown1;
unsigned long dwJobID;
unsigned long dwPriority;
unsigned long offUserName; //Offset of WideChar+0
unsigned long offNotifyName; //Offset of WideChar+0
unsigned long offDocumentName; //Offset of WideChar+0
unsigned long offPort; //Offset of WideChar+0
unsigned long offPrinterName; //Offset of WideChar+0
unsigned long offDriverName; //Offset of WideChar+0
unsigned long offDevMode; //Offset of DEVMODE
unsigned long offPrintProcessor; //Offset of WideChar+0
unsigned long offDataFormat; //Offset of WideChar+0
unsigned long dwUnknown2;
SystemTime stSubmitTime;
unsigned long dwStartTime;
unsigned long dwUntilTime;
unsigned long dwSizeSPL; //Size of SPL File
unsigned long dwPageCount;
unsigned long dwSizeSecurityInfo; //Size of SecurityInfo
unsigned long offSecurityInfo; //Offset of SECURITY_DESCRIPTOR
unsigned long dwUnknown3;
unsigned long dwUnknown4;
unsigned long dwUnknown5;
unsigned long offComputername; //Offset of WideChar+0
unsigned long dwSPLSize2;
} SHADOW_FILE_HEADER_WIN2000, * PSHADOW_FILE_HEADER_WIN2000;
typedef struct __SHADOW_FILE_HEADER_WIN2000_64 {
unsigned long dwSignature; //SHD_SIGNATURE_WIN2000
unsigned long dwHeaderSize;
unsigned short wStatus;
unsigned short wUnknown1;
unsigned long dwJobID;
ULONGLONG dwPriority;
ULONGLONG offUserName; //Offset of WideChar+0
ULONGLONG offNotifyName; //Offset of WideChar+0
ULONGLONG offDocumentName; //Offset of WideChar+0
ULONGLONG offPort; //Offset of WideChar+0
ULONGLONG offPrinterName; //Offset of WideChar+0
ULONGLONG offDriverName; //Offset of WideChar+0
ULONGLONG offDevMode; //Offset of DEVMODE
ULONGLONG offPrintProcessor; //Offset of WideChar+0
ULONGLONG offDataFormat; //Offset of WideChar+0
ULONGLONG dwUnknown2;
SystemTime stSubmitTime;
unsigned long dwStartTime;
unsigned long dwUntilTime;
unsigned long dwSizeSPL; //Size of SPL File
unsigned long dwPageCount;
unsigned long dwSizeSecurityInfo; //Size of SecurityInfo
unsigned long offSecurityInfo; //Offset of SECURITY_DESCRIPTOR
unsigned long dwUnknown3;
unsigned long dwUnknown4;
unsigned long dwUnknown5;
unsigned long offComputername; //Offset of WideChar+0
unsigned long dwSPLSize2;
} SHADOW_FILE_HEADER_WIN2000_64, * PSHADOW_FILE_HEADER_WIN2000_64;
BOOL IsWow64()
{
SYSTEM_INFO SysInfo;
GetNativeSystemInfo(&SysInfo);
if (SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64 ||
SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_IA64)
{
return TRUE;
}
return FALSE;
}
BOOL ParseShd_Head()
{
BOOL bRet = IsWow64();
DWORD nNumberOfBytesRead, nNumberOfBytesToRead;
nNumberOfBytesToRead = bRet ? sizeof(SHADOW_FILE_HEADER_WIN2000_64) :
sizeof(SHADOW_FILE_HEADER_WIN2000);
if (bRet)
{
SHADOW_FILE_HEADER_WIN2000_64 Shadow;
bRet = ReadFile(s_DataInfo.hFile, &Shadow, nNumberOfBytesToRead, &nNumberOfBytesRead, NULL);
s_DataInfo.offDevMode.QuadPart = Shadow.offDevMode;
s_DataInfo.dwPageCount = Shadow.dwPageCount;
s_DataInfo.offUserName.QuadPart = Shadow.offUserName;
}
else
{
SHADOW_FILE_HEADER_WIN2000 Shadow;
bRet = ReadFile(s_DataInfo.hFile, &Shadow, nNumberOfBytesToRead, &nNumberOfBytesRead, NULL);
s_DataInfo.offDevMode.QuadPart = Shadow.offDevMode;
s_DataInfo.dwPageCount = Shadow.dwPageCount;
s_DataInfo.offUserName.QuadPart = Shadow.offUserName;
}
if (!bRet)
{
return FALSE;
}
return TRUE;
}
BOOL ParseShd_Data()
{
if (!SetFilePointerEx(s_DataInfo.hFile, s_DataInfo.offDevMode, &s_DataInfo.offDevMode, FILE_BEGIN))
{
return FALSE;
}
DEVMODE Dev;
DWORD nNumberOfBytesToRead,nUserNameLen;
if (!ReadFile(s_DataInfo.hFile, &Dev, sizeof(Dev), &nNumberOfBytesToRead, NULL) || nNumberOfBytesToRead != sizeof(Dev))
{
return FALSE;
}
if (!SetFilePointerEx(s_DataInfo.hFile, s_DataInfo.offUserName, &s_DataInfo.offUserName, FILE_BEGIN))
{
return FALSE;
}
LARGE_INTEGER nFileSize = { 0 };
GetFileSizeEx(s_DataInfo.hFile, &nFileSize);
nUserNameLen = nFileSize.QuadPart - s_DataInfo.offUserName.QuadPart;
s_DataInfo.PrintTaskUserName.resize(nUserNameLen, 0);
if (!ReadFile(s_DataInfo.hFile, (wchar_t *)s_DataInfo.PrintTaskUserName.data(), nUserNameLen, &nNumberOfBytesToRead, NULL) || nNumberOfBytesToRead != nUserNameLen)
{
return FALSE;
}
return TRUE;
}
BOOL ParseShd(LPCTSTR lpFileName)
{
s_DataInfo.hFile = CreateFile(lpFileName,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
0,
NULL);
if (!s_DataInfo.hFile || s_DataInfo.hFile == INVALID_HANDLE_VALUE)
{
return FALSE;
}
if (!ParseShd_Head())
{
return FALSE;
}
if (!ParseShd_Data())
{
return FALSE;
}
return TRUE;
}
int main(void)
{
ParseShd(L"C:\\Windows\\System32\\spool\\PRINTERS\\00002.SHD");
return 0;
}
windows c++ 解析 SHD 文件
最新推荐文章于 2024-08-22 17:56:09 发布