为什么查找PE的特征代码失败？
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;
type
TForm1 = class(TForm)
btn1: TButton;
lbl1: TLabel;
procedure btn1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
function HexToString(S: ansistring): ansistring;
var
i: integer;
Begin
Result := '';
for i := 1 to Length(S) do
begin
if ((i mod 2)=1) then
begin
Result:=Result + ansistring(Chr(StrToInt('0x' + Copy(S, i, 2))));
end;
end;
end;
function HexScan(t:tstream; s:ansistring):integer;
var
i,j: integer;
p: pansichar;
begin
Result:=-1;
getmem(p, t.size); // ---- 分配内存
t.readbuffer(p^, t.size );// ---- 读
for i:=0 to t.size -1 do
begin
for j:=1 to length(s) do
begin
if p[i+j]<>s[j] then // ---- 有一个不同即退出
begin
break;
end;
end;
if j>length(s) then // ---- 依据
begin
Result:=i+1;
break;
end;
end;
freemem(p);
t.seek(0, soBeginning); // ---- 返回文件头
end;
procedure TForm1.btn1Click(Sender: TObject);
var
MyFile: TFileStream;
Code: ansistring;
mm: ansistring;
Addr: Integer;
begin
MyFile:=TFileStream.Create('E:\1.exe', fmShareDenyNone);
Code:='83C40484C07502B30184DB74598D9538F7FFFF5268E8030000';//确定这个exe中有这个特征码
Addr:=HexScan(MyFile, HexToString(Code));
mm:=HexToString(Code);
if Addr<>0 then
begin
form1.lbl1.caption:=IntToStr(Addr);//这里的Addr没有返回地址 返回-1
end;
end;
end.
