PE CheckSum calc func

kick

Магистр Йода
Administrator
Сообщения
5.010
Розыгрыши
3
Реакции
3.563
Баллы
6.485
Код:
//

UINT32 CalcCheckSum(BYTE* _data, UINT32 _data_size, UINT32 _data_checkSumOffset)
{
    UINT32 _checksum = 0, _i, _i_max;

    _i_max = (_data_checkSumOffset / sizeof(UINT16));
    for(_i = 0; _i < _i_max; _i++)
        _checksum += ((UINT16*)_data)[_i];

    _i_max = (_data_size / sizeof(UINT16));
    for(_i += (sizeof(UINT32) / sizeof(UINT16)); _i < _i_max; _i++)
        _checksum += ((UINT16*)_data)[_i];

    _checksum = ((_checksum >> (sizeof(UINT16) * CHAR_BIT)) + ((UINT16)_checksum));
    _checksum = (_checksum + (_checksum >> (sizeof(UINT16) * CHAR_BIT)));
    _checksum = (_data_size + ((UINT16)_checksum));

    return _checksum;
};

//

VOID Msg(const WCHAR* format = L"", ...)
{
    WCHAR pBuff[2048];
    va_list va;
    va_start(va, format);
    vswprintf_s(pBuff, 2048, format, va);
    MessageBoxW(0, pBuff, L"", MB_OK);
    va_end(va);
};

//

    FILE* pFile = _wfopen(L"DllFile.dll", L"rb");
    if(pFile)
    {
        fseek(pFile, 0, SEEK_END);
        UINT32 _file_size = (UINT32)ftell(pFile);
        fseek(pFile, 0, SEEK_SET);

        string _file_buff;
        _file_buff.resize(_file_size);

        if(fread((LPVOID)_file_buff.c_str(), _file_size, 1, pFile) == 1)
        {
            fclose(pFile); pFile = NULL;

            //

            ULONG_PTR _file = (ULONG_PTR)_file_buff.c_str(), _file_size = (ULONG_PTR)_file_buff.size();

            if(((PIMAGE_DOS_HEADER)_file)->e_magic == IMAGE_DOS_SIGNATURE)
            {
                PIMAGE_NT_HEADERS _pinth = (PIMAGE_NT_HEADERS)(_file + ((PIMAGE_DOS_HEADER)_file)->e_lfanew);

                switch(_pinth->OptionalHeader.Magic)
                {
                case IMAGE_NT_OPTIONAL_HDR32_MAGIC:
                    {
                        PIMAGE_NT_HEADERS32 pinth = (PIMAGE_NT_HEADERS32)_pinth;

                        Msg(L"in_file: 0x%08X, calculated: 0x%08X (X86)", pinth->OptionalHeader.CheckSum, CalcCheckSum((BYTE*)_file, ((UINT32)_file_size), ((UINT32)(((ULONG_PTR)&pinth->OptionalHeader.CheckSum) - _file))));

                        break;
                    }
                case IMAGE_NT_OPTIONAL_HDR64_MAGIC:
                    {
                        PIMAGE_NT_HEADERS64 pinth = (PIMAGE_NT_HEADERS64)_pinth;

                        Msg(L"in_file: 0x%08X, calculated: 0x%08X (X64)", pinth->OptionalHeader.CheckSum, CalcCheckSum((BYTE*)_file, ((UINT32)_file_size), ((UINT32)(((ULONG_PTR)&pinth->OptionalHeader.CheckSum) - _file))));

                        break;
                    }
                }

                //
            }

            //
        }
        else
        {
            fclose(pFile); pFile = NULL;
        }
    }

//
 
Сверху Снизу