如何测试 Windows DLL 文件以确定它是 32 位还是 64 位? [英] How can I test a Windows DLL file to determine if it is 32 bit or 64 bit?

问题描述

我想编写一个测试脚本或程序，断言给定目录中的所有 DLL 文件都属于特定的构建类型.

I'd like to write a test script or program that asserts that all DLL files in a given directory are of a particular build type.

我会在 SDK 的构建过程结束时使用它作为完整性检查，以确保 64 位版本没有以某种方式在其中包含一些 32 位 DLL 文件，反之亦然.

I would use this as a sanity check at the end of a build process on an SDK to make sure that the 64-bit version hasn't somehow got some 32-bit DLL files in it and vice versa.

是否有一种简单的方法可以查看 DLL 文件并确定其类型?

Is there an easy way to look at a DLL file and determine its type?

该解决方案应该适用于 xp32 和 xp64.

The solution should work on both xp32 and xp64.

推荐答案

血腥细节

DLL 使用 PE 可执行格式，从文件中读取该信息并不太难.

Gory details

A DLL uses the PE executable format, and it's not too tricky to read that information out of the file.

请参阅此 有关 PE 文件格式的 MSDN 文章 概览.您需要阅读 MS-DOS 标头，然后阅读 IMAGE_NT_HEADERS 结构.这包含 IMAGE_FILE_HEADER 结构，其中包含您的信息需要包含以下值之一的 Machine 成员

See this MSDN article on the PE File Format for an overview. You need to read the MS-DOS header, then read the IMAGE_NT_HEADERS structure. This contains the IMAGE_FILE_HEADER structure which contains the info you need in the Machine member which contains one of the following values

• IMAGE_FILE_MACHINE_I386 (0x014c)
• IMAGE_FILE_MACHINE_IA64 (0x0200)
• IMAGE_FILE_MACHINE_AMD64 (0x8664)

此信息应该在文件中的固定偏移量处，但我仍然建议遍历文件并检查 MS-DOS 标头和 IMAGE_NT_HEADERS 的签名，以确保您能应对未来的任何更改.

This information should be at a fixed offset in the file, but I'd still recommend traversing the file and checking the signature of the MS-DOS header and the IMAGE_NT_HEADERS to be sure you cope with any future changes.

您还可以使用 ImageHelp API为此 - 使用 LoadImage 加载 DLL 和你会得到一个 LOADED_IMAGE 结构，其中将包含指向 IMAGE_NT_HEADERS 结构的指针.使用 ImageUnload 解除分配 LOADED_IMAGE.

You can also use the ImageHelp API to do this - load the DLL with LoadImage and you'll get a LOADED_IMAGE structure which will contain a pointer to an IMAGE_NT_HEADERS structure. Deallocate the LOADED_IMAGE with ImageUnload.

这是完成工作的粗略 Perl 脚本.它检查文件是否有 DOS 头，然后从 IMAGE_DOS_HEADER 60 字节读取 PE 偏移量到文件中.

Here's rough Perl script which gets the job done. It checks the file has a DOS header, then reads the PE offset from the IMAGE_DOS_HEADER 60 bytes into the file.

然后它会寻找 PE 部分的开头，读取签名并检查它，然后提取我们感兴趣的值.

It then seeks to the start of the PE part, reads the signature and checks it, and then extracts the value we're interested in.

#!/usr/bin/perl
#
# usage: petype <exefile>
#
$exe = $ARGV[0];

open(EXE, $exe) or die "can't open $exe: $!";
binmode(EXE);
if (read(EXE, $doshdr, 64)) {

   ($magic,$skip,$offset)=unpack('a2a58l', $doshdr);
   die("Not an executable") if ($magic ne 'MZ');

   seek(EXE,$offset,SEEK_SET);
   if (read(EXE, $pehdr, 6)){
       ($sig,$skip,$machine)=unpack('a2a2v', $pehdr);
       die("No a PE Executable") if ($sig ne 'PE');

       if ($machine == 0x014c){
            print "i386
";
       }
       elsif ($machine == 0x0200){
            print "IA64
";
       }
       elsif ($machine == 0x8664){
            print "AMD64
";
       }
       else{
            printf("Unknown machine type 0x%lx
", $machine);
       }
   }
}

close(EXE);

这篇关于如何测试 Windows DLL 文件以确定它是 32 位还是 64 位?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！