查壳程序代码

PEID基于特征码的，用python只需要两行代码，用VC实现用了这么多代码……。

python中只要引入pefile模块，第一句代码指定数据库文件，第二句代码返回结果..具体看pefile官方介绍吧

下面是C的代码...

void CMyPeidDlg::OnBnClickedBtnOpen()
{
	// 获取当前工作路径
	CString strAppName;//当前工作目录
	::GetModuleFileName(NULL, strAppName.GetBuffer(_MAX_PATH), _MAX_PATH);
	strAppName.ReleaseBuffer();
	int nPos = strAppName.ReverseFind('//');
	strAppName = strAppName.Left(nPos + 1);

	// AfxMessageBox(strAppName);


	// 文件扩展名过滤器
	LPCTSTR szFilter = "EXE Files (*.EXE)|*.EXE|DLL Files (*.DLL)|*.DLL|All Files (*.*)|*.*||";

	//初始目录是c:/windows, 初始选择的文件名是test，初始后缀过滤器是 Chart Files (*.xlc)
	CFileDialog dlg(TRUE,NULL ,strAppName.GetBuffer(_MAX_PATH) ,OFN_ENABLESIZING ,szFilter,NULL);
	if(dlg.DoModal() == IDOK)
	{
		CString strFile = dlg.GetPathName(); // 全路径
		GetDlgItem(IDC_EDT_FILE)->SetWindowText(strFile.GetBuffer(_MAX_PATH));

		TRACE("/n&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&/n");
		TRACE(strFile);
		TRACE("/n&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&/n");
	}
}

void CMyPeidDlg::OnBnClickedBtnOk()
{
	GetDlgItem(IDC_EDT_FILE)->SetWindowText("c:\\1.exe");

	char buf[_MAX_PATH];
	ZeroMemory(buf, _MAX_PATH);
	GetDlgItemText(IDC_EDT_FILE, buf, _MAX_PATH-1);
	HANDLE hFile = CreateFile(buf, GENERIC_READ,FILE_SHARE_READ, NULL, OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
	if (!hFile)
	{
		MessageBox("createFile failed..");
		return;
	}
	HANDLE hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0,NULL);
	if (!hMap)
	{
		MessageBox("hMap failed..");
		return;
	}
	LPVOID lpBase = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);
	if (!lpBase)
	{
		MessageBox("lpBase failed..");
		return;
	}

	DWORD dwOEP;
	IMAGE_DOS_HEADER *pDosHeader = (IMAGE_DOS_HEADER*)lpBase;
	IMAGE_NT_HEADERS *pNtHeader = (IMAGE_NT_HEADERS*)((char*)lpBase + pDosHeader->e_lfanew);
	dwOEP = pNtHeader->OptionalHeader.AddressOfEntryPoint;

	PIMAGE_SECTION_HEADER pSectionHeader = IMAGE_FIRST_SECTION(pNtHeader);
	
	CString strTemp;
	strTemp.Format("%0x",dwOEP);
	SetDlgItemText(IDC_EDT_OEP, strTemp.GetBuffer(4));

	DWORD FileOffset;
	for(int i=0; i<pNtHeader->FileHeader.NumberOfSections;i++)
	{
		if (dwOEP >= pSectionHeader->VirtualAddress && 
			dwOEP < pSectionHeader->VirtualAddress + pSectionHeader->SizeOfRawData)
		{
			FileOffset = dwOEP - pSectionHeader->VirtualAddress + pSectionHeader->PointerToRawData;
		}
		pSectionHeader++;
	}

	strTemp.Empty();
	strTemp.Format("%0x",FileOffset);
	SetDlgItemText(IDC_EDT_FILEOFFSET, strTemp.GetBuffer(4));

	//从文件偏移开始读特征码
	CString strBuf;
	DWORD dwReaded;
	SetFilePointer(hFile, FileOffset,0, FILE_BEGIN);
	ReadFile(hFile, strBuf.GetBuffer(16), 16, &dwReaded,NULL);
	MessageBox(strBuf.GetBuffer(16));

	char code[] = "\x60\xE8\x03\x00\x00\x00\xE9\xEB\04\x5D\x45\x55\xC3\xE8\x01";
	char fileBuf[16];
	memcpy(fileBuf, strBuf.GetBuffer(16),16);
	char ctype[20];
	for (int i=0;i<16;i++)
	{
		if (code[i]!=fileBuf[i])
		{
			StrCpy(ctype,"not found");
			break;
		}
		else if (i==15)
		{
			StrCpy(ctype, "aspack");
		}
	}
	
	SetDlgItemText(IDC_EDT_SHELLTYPE, ctype);
	
}