判断PE文件是不是64位的函数

 

#include <iostream>
#include <fstream>

#include <windows.h>
#include <winnt.h>

bool pe_is_64bit(const char *pfile)
{
	bool bret = false;
	IMAGE_DOS_HEADER idosh = {0};
	IMAGE_NT_HEADERS inth = {0};

	std::ifstream fin;
	fin.open(pfile,std::ios::in|std::ios::binary);
	if(!fin.is_open())
		return false;
	fin.clear();
	fin.seekg(0,std::ios_base::beg);
	fin.read((char *)&idosh,sizeof(IMAGE_DOS_HEADER));
	if(idosh.e_magic != IMAGE_DOS_SIGNATURE)
	{// signature 'MZ'
		fin.clear();
		fin.close();
		return false;
	}
	
	fin.seekg(idosh.e_lfanew,std::ios_base::beg);
	fin.read((char *)&inth,sizeof(IMAGE_NT_HEADERS));
	if(inth.Signature != IMAGE_NT_SIGNATURE)
	{
		fin.clear();
		fin.close();
		return false;
	}
	
	if(inth.FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 ||
		inth.FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 ) // may be IMAGE_FILE_MACHINE_I386
		bret = true;
	fin.clear();
	fin.close();
	return bret;
}