读取PE COFF头并获取特征标志

#include <iostream>
#include <windows.h>

int main() {
    // 打开可执行文件
    HANDLE hFile = CreateFile("example.exe", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile == INVALID_HANDLE_VALUE) {
        std::cout << "Failed to open file." << std::endl;
        return 1;
    }

    // 创建文件映射
    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
    if (hMapping == NULL) {
        std::cout << "Failed to create file mapping." << std::endl;
        CloseHandle(hFile);
        return 1;
    }

    // 将文件映射到内存
    LPVOID lpBaseAddress = MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0);
    if (lpBaseAddress == NULL) {
        std::cout << "Failed to map view of file." << std::endl;
        CloseHandle(hMapping);
        CloseHandle(hFile);
        return 1;
    }

    // 获取PE COFF头
    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)lpBaseAddress;
    PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)lpBaseAddress + pDosHeader->e_lfanew);
    DWORD characteristics = pNtHeaders->FileHeader.Characteristics;

    // 输出特征标志
    std::cout << "特征标志：" << std::hex << characteristics << std::endl;

    // 关闭文件映射和文件句柄
    UnmapViewOfFile(lpBaseAddress);
    CloseHandle(hMapping);
    CloseHandle(hFile);

    return 0;
}