-
Notifications
You must be signed in to change notification settings - Fork 1
/
file-pe.h
76 lines (60 loc) · 1.33 KB
/
file-pe.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
/*
** peÏà¹Ø
** author
*/
#ifndef ULT_FILE_FILEPE_H_
#define ULT_FILE_FILEPE_H_
#include "file-io.h"
namespace ult{
class FilePE {
public:
FilePE(void) {
memset(&dos_header_, 0, sizeof (dos_header_));
memset(&nt_headers_, 0, sizeof (nt_headers_));
}
~FilePE(void) {
file_.Close();
}
bool Open(const std::wstring& filename) {
file_.Close();
if (!file_.Open(filename)) {
return false;
}
DWORD dwread;
if (!file_.Read(&dos_header_, sizeof(IMAGE_DOS_HEADER), &dwread)) {
return false;
}
unsigned __int64 new_position;
if (!file_.Seek(dos_header_.e_lfanew, &new_position)) {
return false;
}
if (!file_.Read(&nt_headers_, sizeof(IMAGE_NT_HEADERS), &dwread)) {
return false;
}
file_.SeekToBegin();
return true;
}
bool Close(void) {
return file_.Close();
}
bool IsValidPE(void) {
if (dos_header_.e_magic != IMAGE_DOS_SIGNATURE ||
nt_headers_.Signature != IMAGE_NT_SIGNATURE) {
return false;
}
return true;
}
DWORD GetSignSize(void) {
if (!IsValidPE()) {
return 0;
}
return nt_headers_.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size;
}
private:
File file_;
IMAGE_DOS_HEADER dos_header_;
IMAGE_NT_HEADERS nt_headers_;
};
}//namespace ult
#endif