I would like to get the sha-2开发者_如何学Python56 hash for a section which contains code(.text, CODE) in a Portable Executable file, in Delphi.
So far, I've tried to get the start and end address of the section to which the AddressOfEntryPoint points to, but if I load the same file several times, I get different start and end addresses.
Can anyone please help me?
This is the code:
procedure TForm1.Button1Click(Sender: TObject);
var x:TJCLPEImage;
aoep,cs,ce: cardinal;
pise: Pimagesectionheader;
nos : integer;
i : integer;
begin
x := TJCLPEImage.Create();
x.FileName:=edit1.Text;
aoep := x.OptionalHeader32.AddressOfEntryPoint;
pise := Pointer(PByte(@(x.LoadedImage.FileHeader.OptionalHeader)) + x.LoadedImage.FileHeader.FileHeader.SizeOfOptionalHeader);
for i:=0 to x.ImageSectionCount-1 do
begin
if (pise.VirtualAddress <= aoep) and (aoep < (pise.VirtualAddress + pise.Misc.VirtualSize)) then
break;
end;
inc(pise);
cs := DWORD(x.LoadedImage.MappedAddress) + DWORD(pise.PointerToRawData);
ce := cs + pise.Misc.VirtualSize;
Label1.caption:='Code start: '+Inttostr(cs);
Label2.caption:='Code end: '+inttostr(ce);
end;
Thank you.
I cant comment to your question yet, so i am trying to reply here, but not sure if i am thinking right about what you are asking.
Seems you want a way to assure no one changed your file after it loaded in memory. That's why you want a sha-256 hash of that section, and probably you need to get that section and then hash it.
I never used JCL classes to do that. But found this unit that maybe help for you. It allow you to edit PE files. Was written in 2007, so maybe you will need upgrade some code. But i am most sure you will find the bases to what you want. http://www.coderprofile.com/networks/source-codes/71/portable-executable-file-unit
I could not test it at all. But till what i tested, the start address did not changed here..
To get the Sha-256, will find many VCL components (or at least ActiveX) to do that. I could advise you to use LIBEAY32.DLL, but that would probably add one more dll to your application. Unless you already use it.
Hope that help in anyway.
精彩评论