获取pe文件的文件类型

工程文件petype.cpp通过调用pefile类中的函数获取文件类型。

文件类型的判断通过5个监测点完成。

监测点1：dos头的e_magic

监测点2：nt头的Signature

监测点3：文件头的Characteristics

监测点4：可选头的Magic

监测点5：可选头的Subsystem

通过监测点1和2判断是否是pe文件；

通过监测点3判断文件是否是动态库文件

通过监测点4判断文件是pe32还是pe32+还是rom映像

通过监测点5判断文件是否是0环可执行文件[驱动文件]，还是3环可执行文件[exe文件]

具体代码参见下面：

pefile.h

 #ifndef PE_FILE_H
 #define PE_FILE_H
 #include "windows.h"

 #define ISMZHEADER            (*(WORD*)File_memory == 0x5a4d)
 #define ISPEHEADER            (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c)) == 0x4550)
 #define ISPE32MAGIC            (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x10b)
 #define ISPE64MAGIC            (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x20b)
 #define ISPEROMMAGIC        (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x107)

 #define X_PE_32                32
 #define X_PE_64                64

 #define    READ_ERRO            0x0
 #define    NOT_PE_FILE            0x200
 #define    PE_FILE                0x100
 #define    PE64_FILE            0x40
 #define    PE32_FILE            0x20
 #define    ROM_IMAGE            0x10
 #define    EXE_FILE            0x8
 #define    DLL_FILE            0x4
 #define    SYS_FILE            0x2
 #define    OTHER_FILE            0x1

 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
 #define X_EXPORT            0
 #define X_IMPORT            1
 #define X_RESOURSE            2
 #define X_EXCEPTION            3
 #define X_CERTIFICATE        4
 #define X_BASE_RELOCATION    5
 #define X_DEBUG                6
 #define X_ARCHITECTURE        7
 #define X_GLOBAL_PTR        8
 #define X_TLS                9
 #define X_LOAD_CONFIG        10
 #define X_BAND_IMPORT        11
 #define X_IAT                12
 #define X_DELAY_IMPORT        13
 #define X_COM_HEADER        14
 #define X_RESERVED            15

 typedef struct X_IMAGE_DOS_HEADER {      // DOS .EXE header
     WORD   e_magic;                     // Magic number
     WORD   e_cblp;                      // Bytes on last page of file
     WORD   e_cp;                        // Pages in file
     WORD   e_crlc;                      // Relocations
     WORD   e_cparhdr;                   // Size of header in paragraphs
     WORD   e_minalloc;                  // Minimum extra paragraphs needed
     WORD   e_maxalloc;                  // Maximum extra paragraphs needed
     WORD   e_ss;                        // Initial (relative) SS value
     WORD   e_sp;                        // Initial SP value
     WORD   e_csum;                      // Checksum
     WORD   e_ip;                        // Initial IP value
     WORD   e_cs;                        // Initial (relative) CS value
     WORD   e_lfarlc;                    // File address of relocation table
     WORD   e_ovno;                      // Overlay number
     WORD   e_res[];                    // Reserved words
     WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
     WORD   e_oeminfo;                   // OEM information; e_oemid specific
     WORD   e_res2[];                  // Reserved words
     LONG   e_lfanew;                    // File address of new exe header
   } MX_IMAGE_DOS_HEADER;

 typedef struct X_IMAGE_FILE_HEADER {
     WORD    Machine;
     WORD    NumberOfSections;
     DWORD   TimeDateStamp;
     DWORD   PointerToSymbolTable;
     DWORD   NumberOfSymbols;
     WORD    SizeOfOptionalHeader;
     WORD    Characteristics;
 } MX_IMAGE_FILE_HEADER;

 typedef struct X_IMAGE_DATA_DIRECTORY {
     DWORD   VirtualAddress;
     DWORD   Size;
 } MX_IMAGE_DATA_DIRECTORY;

 typedef struct X_IMAGE_OPTIONAL_HEADER32 {
     WORD    Magic;
     BYTE    MajorLinkerVersion;
     BYTE    MinorLinkerVersion;
     DWORD   SizeOfCode;
     DWORD   SizeOfInitializedData;
     DWORD   SizeOfUninitializedData;
     DWORD   AddressOfEntryPoint;
     DWORD   BaseOfCode;
     DWORD   BaseOfData;
     DWORD   ImageBase;
     DWORD   SectionAlignment;
     DWORD   FileAlignment;
     WORD    MajorOperatingSystemVersion;
     WORD    MinorOperatingSystemVersion;
     WORD    MajorImageVersion;
     WORD    MinorImageVersion;
     WORD    MajorSubsystemVersion;
     WORD    MinorSubsystemVersion;
     DWORD   Win32VersionValue;
     DWORD   SizeOfImage;
     DWORD   SizeOfHeaders;
     DWORD   CheckSum;
     WORD    Subsystem;
     WORD    DllCharacteristics;
     DWORD   SizeOfStackReserve;
     DWORD   SizeOfStackCommit;
     DWORD   SizeOfHeapReserve;
     DWORD   SizeOfHeapCommit;
     DWORD   LoaderFlags;
     DWORD   NumberOfRvaAndSizes;
     MX_IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 } MX_IMAGE_OPTIONAL_HEADER32;

 typedef struct X_IMAGE_OPTIONAL_HEADER64 {
     WORD        Magic;
     BYTE        MajorLinkerVersion;
     BYTE        MinorLinkerVersion;
     DWORD       SizeOfCode;
     DWORD       SizeOfInitializedData;
     DWORD       SizeOfUninitializedData;
     DWORD       AddressOfEntryPoint;
     DWORD       BaseOfCode;
     ULONGLONG   ImageBase;
     DWORD       SectionAlignment;
     DWORD       FileAlignment;
     WORD        MajorOperatingSystemVersion;
     WORD        MinorOperatingSystemVersion;
     WORD        MajorImageVersion;
     WORD        MinorImageVersion;
     WORD        MajorSubsystemVersion;
     WORD        MinorSubsystemVersion;
     DWORD       Win32VersionValue;
     DWORD       SizeOfImage;
     DWORD       SizeOfHeaders;
     DWORD       CheckSum;
     WORD        Subsystem;
     WORD        DllCharacteristics;
     ULONGLONG   SizeOfStackReserve;
     ULONGLONG   SizeOfStackCommit;
     ULONGLONG   SizeOfHeapReserve;
     ULONGLONG   SizeOfHeapCommit;
     DWORD       LoaderFlags;
     DWORD       NumberOfRvaAndSizes;
     IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 } MX_IMAGE_OPTIONAL_HEADER64;

 typedef struct X_IMAGE_NT_HEADERS32 {
     DWORD Signature;
     MX_IMAGE_FILE_HEADER FileHeader;
     MX_IMAGE_OPTIONAL_HEADER32 OptionalHeader;
 } MX_IMAGE_NT_HEADERS32;

 typedef struct X_IMAGE_NT_HEADERS64 {
     DWORD Signature;
     MX_IMAGE_FILE_HEADER FileHeader;
     MX_IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 } MX_IMAGE_NT_HEADERS64;

 class XPEFILE
 {
 public:
     XPEFILE(char* lpFileName);
     virtual ~XPEFILE();
     int GetType();
     int GetSize();
 private:
     void* File_memory;
     int File_size;
     int File_type;
 };

 #endif

pefile.h

pefile.cpp

 #include "stdafx.h"
 #include "windows.h"
 #include "pefile.h"
 #include <iostream>

 XPEFILE::XPEFILE(char* strFileName)
 {
     HANDLE hfile;
     unsigned long sizehigh;
     void* lpmemory;

     File_memory = NULL;
     File_type = READ_ERRO;

     hfile = CreateFile(strFileName, GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,,OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN,);
     if (hfile != INVALID_HANDLE_VALUE)
     {
         File_size = GetFileSize(hfile, NULL);
         lpmemory = LocalAlloc(LPTR,File_size);
         if(ReadFile(hfile,lpmemory,File_size,&sizehigh,) != NULL)
         {
             File_memory = lpmemory;
         }
         CloseHandle(hfile);
     }
 }

 XPEFILE::~XPEFILE()
 {
     if (File_memory == NULL)
     {
         LocalFree(File_memory);
     }
 }

 int XPEFILE::GetSize()
 {
     return File_size;
 }

 int XPEFILE::GetType()
 {
     MX_IMAGE_NT_HEADERS32* ntheader32;
     MX_IMAGE_NT_HEADERS64* ntheader64;

     File_type = READ_ERRO;

     if (File_memory == NULL)
     {
         return File_type;
     }
     File_type = NOT_PE_FILE;
 //    if ((*(WORD*)File_memory == 0x5a4d)    && (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c)) == 0x4550))
     if(ISMZHEADER && ISPEHEADER)
     {
         File_type = PE_FILE;
     }
     if (File_type == PE_FILE)
     {
 //        if (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x10b)
         if (ISPE32MAGIC)
         {
             File_type = File_type | PE32_FILE;
             ntheader32 = (MX_IMAGE_NT_HEADERS32*) ((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c));
             if (ntheader32->FileHeader.Characteristics & 0x2000)
             {
                 File_type = File_type | DLL_FILE;
             }
             else if ((ntheader32->OptionalHeader.Subsystem & )|(ntheader32->OptionalHeader.Subsystem & ))
             {
                 File_type = File_type | EXE_FILE;
             }
             else if (ntheader32->OptionalHeader.Subsystem & )
             {
                 File_type = File_type | SYS_FILE;
             }
         }
 //        if (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x20b)
         if (ISPE64MAGIC)
         {
             File_type = File_type | PE64_FILE;
             ntheader64 = (MX_IMAGE_NT_HEADERS64*) ((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c));
             if (ntheader64->FileHeader.Characteristics & 0x2000)
             {
                 File_type = File_type | DLL_FILE;
             }
             else if ((ntheader64->OptionalHeader.Subsystem & )|(ntheader64->OptionalHeader.Subsystem & ))
             {
                 File_type = File_type | EXE_FILE;
             }
             else if (ntheader64->OptionalHeader.Subsystem & )
             {
                 File_type = File_type | SYS_FILE;
             }
         }
 //        if (*(WORD*)((BYTE*)File_memory + *(DWORD*)((BYTE*)File_memory + 0x3c) + sizeof(MX_IMAGE_FILE_HEADER) + 4) == 0x107)
         if (ISPEROMMAGIC)
         {
             File_type = File_type | ROM_IMAGE;
         }
     }
     return  File_type;
 }

pefile.cpp

petype.cpp

 #include "stdafx.h"
 #include "pefile.h"
 #include <iostream>

 int main(int argc, char* argv[])
 {
     int filetype;

     char* file = "c:\\1.exe";
     XPEFILE pefile1(file);

     filetype = pefile1.GetType();

     system("pause");
     return ;
 }

petype.cpp