Sha*_*men 13
使用ImageNtHeader(...)获取文件的PE数据,然后检查IMAGE_FILE_HEADER.Machine字段.
没有清理并且没有错误检查
// map the file to our address space
// first, create a file mapping object
hMap = CreateFileMapping(
hFile,
NULL, // security attrs
PAGE_READONLY, // protection flags
0, // max size - high DWORD
0, // max size - low DWORD
NULL ); // mapping name - not used
// next, map the file to our address space
void* mapAddr = MapViewOfFileEx(
hMap, // mapping object
FILE_MAP_READ, // desired access
0, // loc to map - hi DWORD
0, // loc to map - lo DWORD
0, // #bytes to map - 0=all
NULL ); // suggested map addr
peHdr = ImageNtHeader( mapAddr );
Run Code Online (Sandbox Code Playgroud)
| 归档时间: |
|
| 查看次数: |
5256 次 |
| 最近记录: |