如何检查exe是否设置为LARGEADDRESSAWARE

Question

我正在开发一个C#程序,它将加载文件并获取诸如加载文件创建日期,修改日期,大小等信息.我需要知道的另一件事是加载的文件(executable.exe)是否与LARGEADDRESSAWARE标志链接.FileInfo类不提供此信息.

有谁知道如何在C#中找出给定的execute.exe是否与LARGEADDRESSAWARE标志链接(处理大于2 GB的地址)？

Answer 1

以下是一些检查Large Address Aware标志的代码.您所要做的就是传递一个指向可执行文件开头的流.

IsLargeAware("some.exe");

static bool IsLargeAware(string file)
{
    using (var fs = File.OpenRead(file))
    {
        return IsLargeAware(fs);
    }
}
/// <summary>
/// Checks if the stream is a MZ header and if it is large address aware
/// </summary>
/// <param name="stream">Stream to check, make sure its at the start of the MZ header</param>
/// <exception cref=""></exception>
/// <returns></returns>
static bool IsLargeAware(Stream stream)
{
    const int IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x20;

    var br = new BinaryReader(stream);

    if (br.ReadInt16() != 0x5A4D)       //No MZ Header
        return false;

    br.BaseStream.Position = 0x3C;
    var peloc = br.ReadInt32();         //Get the PE header location.

    br.BaseStream.Position = peloc;
    if (br.ReadInt32() != 0x4550)       //No PE header
        return false;

    br.BaseStream.Position += 0x12;
    return (br.ReadInt16() & IMAGE_FILE_LARGE_ADDRESS_AWARE) == IMAGE_FILE_LARGE_ADDRESS_AWARE;
}

Answer 2

在MSDN文档的/LARGEADDRESSAWARE状态:

如果应用程序与/ LARGEADDRESSAWARE链接,则DUMPBIN/HEADERS将显示该效果的信息.

如果您正在寻找以编程方式执行此操作的方法,则可以从应用程序调用dumpbin并解析输出.

更新:

这里还有一篇很好的博客文章,可以更深入地讨论这个问题.