feature.h

PE文件加壳信息的检测

//===================================================================
/** \file  
* Filename :   CFeature.h
* Desc     :   
* His      :   Windy create @2006-3-6 9:54:55
*/
//===================================================================
#ifndef __CFEATURE_H__
#define __CFEATURE_H__
#include <vector>
//定义特征码结构体
typedef struct _Feature
{
	LPCTSTR  Pos;
	LPCTSTR  Fea;
	LPCTSTR  Info;
	bool IsOrdered;
}Feature,*PFeature;

typedef std::vector<Feature> FeatureVec;

//!加壳信息全局表声明
extern CONST Feature	 g_ShellInfoTab[];
DWORD	GetItemCount();
//!
// 将 RVA 转换成实际的数据位置
DWORD	RVA2Offset(LPVOID pFileHead , DWORD dwRVA);

//返回指定位置的十六进制值
char GetHexValue(CONST CString& strHex, int pos);
#endif //__CFEATURE_H__