//pe check函数
//合法返回0，否则-1
//lpExePEBuff是pe文件地址
//nExePELen是pe文件长度
long pe_check(char *lpExePEBuff, unsigned long nExePELen)
{
unsigned long lSectionNum;
unsigned long lFileAlign;
unsigned long lFileAlignMask;
unsigned long lSectionAlignMask;
unsigned long nPointerToRawData;
unsigned long nSizeOfRawData;
unsigned long nSizeOfImage;
unsigned long nIndex;
if (ImageAlignment < PageSize)
{
// The image header is no longer valid, TempPte is
// used to indicate that this image alignment is
// less than a PageSize.
//
// Loop through all sections and make sure there is no
// unitialized data.
//
while (NumberOfSubsections > 0)
{
if (SectionTableEntry->Misc.VirtualSize == 0)
{
SectionVirtualSize = SectionTableEntry->SizeOfRawData;
}
else
{
SectionVirtualSize = SectionTableEntry->Misc.VirtualSize;
}
//
// If the pointer to raw data is zero and the virtual size
// is zero, OR, the section goes past the end of file, OR
// the virtual size does not match the size of raw data, then
// return an error.
//
