如何检查exe文件设置为LARGEADDRESSAWARE [英] how to check if exe is set as LARGEADDRESSAWARE

问题描述

我开发一个C＃程序，将加载文件并获取信息，如加载文件创建日期，修改日期，大小等，我需要知道的另一件事是，是否加载的文件（可执行文件。 exe文件）与 LARGEADDRESSAWARE 标志联系在一起。 FileInfo类不提供此信息。

I am developing a C# program that will load files and get information such as loaded file created date, modification date, size etc. Another thing that I need to know is whether the loaded file (executable.exe) is linked with the LARGEADDRESSAWARE flag. The FileInfo class doesn't provide this information.

有谁知道我是如何在C＃中可以找出是否一个给定的executable.exe与 LARGEADDRESSAWARE 标志（办理地址大于2 GB）？

Does anyone know how in C# can I find out whether a given executable.exe is linked with the LARGEADDRESSAWARE flag (to handle addresses larger than 2 GB)?

推荐答案

下面是一些代码，检查大地址识别标志。所有你需要做的就是传递一个指向一个可执行的开始流。

Here is some code that checks for the Large Address Aware flag. All you have to do is pass a stream that is pointed to the start of an executable.

IsLargeAware("some.exe");

static bool IsLargeAware(string file)
{
    using (var fs = File.OpenRead(file))
    {
        return IsLargeAware(fs);
    }
}
/// <summary>
/// Checks if the stream is a MZ header and if it is large address aware
/// </summary>
/// <param name="stream">Stream to check, make sure its at the start of the MZ header</param>
/// <exception cref=""></exception>
/// <returns></returns>
static bool IsLargeAware(Stream stream)
{
    const int IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x20;

    var br = new BinaryReader(stream);

    if (br.ReadInt16() != 0x5A4D)       //No MZ Header
        return false;

    br.BaseStream.Position = 0x3C;
    var peloc = br.ReadInt32();         //Get the PE header location.

    br.BaseStream.Position = peloc;
    if (br.ReadInt32() != 0x4550)       //No PE header
        return false;

    br.BaseStream.Position += 0x12;
    return (br.ReadInt16() & IMAGE_FILE_LARGE_ADDRESS_AWARE) == IMAGE_FILE_LARGE_ADDRESS_AWARE;
}

这篇关于如何检查exe文件设置为LARGEADDRESSAWARE的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！