漫谈兼容内核之六二进制映像的类型识别（Talking about six of compatible kernel the type recognition of binary image）.docVIP

漫谈兼容内核之六二进制映像的类型识别（Talking about six of compatible kernel the type recognition of binary image） So it is suitable for Linux applications and dynamic link library. The following code can be seen, we read section. [code]enum binary_type MODULE_GetBinaryType (HANDLE hfile, void **res_start, void **res_end) { Union { Struct { Unsigned char magic[4]; Unsigned char ignored[12]; Unsigned short type; Elf}; Struct { Unsigned long magic; Unsigned long cputype; Unsigned long cpusubtype; Unsigned long filetype; Macho}; IMAGE_DOS_HEADER mz; Header}; DWORD len; Seek to the start of the / file and read the header information.. If (SetFilePointer (hfile, 0, NULL, SEEK_SET) = -1) Return BINARY_UNKNOWN; If (! ReadFile (hfile, header, sizeof (header), len, NULL) || len! = sizeof (header)) Return BINARY_UNKNOWN; [/code] Whether it is Linux or Windows, in the directory of the file system is not on file format / type, so we can only adopt the head in front of the actual contents of the file with the show. However, different executable image of the head structure and size are different. Moreover, the head may also be concatenated or nested, namely the level of the head of a big classification, and then by the two head for further subdivision. So here is the definition of a class contains several head structure of Union. The elf is of course Linux ELF format of the image of the head (but not including a.out format, so it is not complete); macho is about to MACH operating system, we do not care; and MZ is DOS and Windows format of a head, this is a relatively large data structure: [code]typedef struct {_IMAGE_DOS_HEADER WORD e_magic 00: MZ Header signature; / * * / WORD e_cblp; 02: Bytes on last page of / * * / file WORD e_cp 04: Pages in file; / * * / WORD e_crlc 06: Relocations; / * * / WORD e_cparhdr; 08: Size of header in paragraphs / * * / WORD e_minalloc 0a: Minimum extra paragraphs needed; / * * / WORD e_maxalloc 0c: Maximum extra paragraphs needed; / * * / WORD e_ss 0e: Initial (rel