FileIsExe

 1 ;******************************************
 2 ;coded by Rrouned
 3 ;******************************************
 4 ;测试子程序FileIsExe 判断是否为PE文件
 5 ;******************************************
 6 
 7 .386
 8 .model flat,stdcall
 9 option casemap:none
10 
11 include        windows.inc
12 include        user32.inc
13 includelib    user32.lib
14 include        kernel32.inc
15 includelib    kernel32.lib
16 
17     .DATA
18 szFilePath db "C:\1.EXE",0 
19 szMsgText    db    "This is a PE file",0
20 szMsgCaption    db    "Caption",0 
21     .DATA?
22 ;hFile    DWORD
23 ;;-----------------------------------------
24     .CODE
25 FileIsExe    Proc
26 LOCAL    ReadBuffer            ;文件读取缓冲区
27 LOCAL    NumberOfBytesRW        ;文件读写字节数
28 local    hFile
29 push esi
30 ;invoke AddLine,addr szFilePath
31 invoke CreateFile,addr szFilePath,GENERIC_READ+GENERIC_WRITE,FILE_SHARE_READ,0,3,FILE_ATTRIBUTE_NORMAL,NULL
32 cmp eax,INVALID_HANDLE_VALUE    ;
33 jz OpenFileErr
34 mov hFile,eax
35 mov ReadBuffer,0
36 invoke SetFilePointer,hFile,0h,NULL,FILE_BEGIN    ;文件指针指向文件头
37 invoke ReadFile,hFile,ADDR ReadBuffer,2,ADDR NumberOfBytesRW,NULL    
38 cmp ReadBuffer,'ZM'
39 JNZ    FileIsNotExe
40 mov ReadBuffer,0
41 invoke SetFilePointer,hFile,3Ch,NULL,FILE_BEGIN;文件头指向xx字段，获取PE头指针
42 invoke ReadFile,hFile,ADDR ReadBuffer,2,ADDR NumberOfBytesRW,NULL
43 mov eax,ReadBuffer
44 mov esi,eax
45 mov ReadBuffer,0
46 invoke SetFilePointer,hFile,esi,NULL,FILE_BEGIN;指向PE头
47 invoke ReadFile,hFile,addr ReadBuffer,2,addr NumberOfBytesRW,NULL
48 cmp ReadBuffer,'EP'
49 jnz    FileNotPe
50 mov eax,esi    ;PE header
51 add eax,16h
52 mov ReadBuffer,0
53 invoke SetFilePointer,hFile,eax,NULL,FILE_BEGIN;指向Characteristics字段
54 invoke ReadFile,hFile,addr ReadBuffer,2,addr NumberOfBytesRW,NULL
55 mov eax,ReadBuffer
56 test ax,2000h
57 jnz    FileMayBeDLL
58 ;invoke AddLine,addr M_FileIsExe
59 invoke CloseHandle,hFile
60 pop esi
61 xor eax,eax
62 inc eax
63 invoke MessageBox,0,addr szMsgText,addr szMsgCaption,0
64 ret
65 OpenFileErr:
66 ;invoke AddLine,
67 pop esi
68 xor eax,eax
69 ret
70 FileIsNotExe:
71 ;invoke Addline,ADDR M_FileIsNotExe
72 pop esi
73 xor eax,eax
74 ret
75 FileNotPe:
76 ;invoke 
77 pop esi
78 xor eax,eax
79 ret
80 FileMayBeDLL:
81 ;invoke AddLine
82 pop esi
83 xor eax,eax
84 ret
85 FileIsExe ENDP
86 
87 start:
88     invoke FileIsExe
89 end start

如果执行没错的话，弹出MSGBOX。

用到的函数如下：

BOOL ReadFile(
    HANDLE hFile, //文件的句柄
    LPVOID lpBuffer, //用于保存读入数据的一个缓冲区
    DWORD nNumberOfBytesToRead, //要读入的字节数
    LPDWORD lpNumberOfBytesRead, //指向实际读取字节数的指针
    LPOVERLAPPED lpOverlapped 
    //如文件打开时指定了FILE_FLAG_OVERLAPPED，那么必须，用这个参数引用一个特殊的结构。
    //该结构定义了一次异步读取操作。否则，应将这个参数设为NULL
);

HANDLE CreateFile(
LPCTSTR lpFileName, //指向文件名的指针
DWORD dwDesiredAccess, //访问模式（写/读）
DWORD dwShareMode, //共享模式
LPSECURITY_ATTRIBUTES lpSecurityAttributes, //指向安全属性的指针
DWORD dwCreationDisposition, //如何创建
DWORD dwFlagsAndAttributes, //文件属性
HANDLE hTemplateFile //用于复制文件句柄
);