win32k内核
5.1.2600.5796 (xpsp_sp3_gdr.090417-1242)
win32k.sys不管系统是PAE还是非PAE，单CPU还是多CPU，都是win32k.sys，这点不会给我们造成困扰。但是ntkrnl就不一样了。对于上面说的nt内核的每1个历史版本，它都有4种版本，分别是
PAE 多CPU
ntoskrnl.exe N N
ntkrnlmp.exe N Y
ntkrnlpa.exe Y N
ntkrpamp.exe Y Y
(假如你在windows\system32下没找到这4个文件的话，你可以到C:\WINDOWS\Driver Cache\i386里去找sp2.cab或sp3.cab，然后
expand sp2.cab -F:ntoskrnl.exe c:\windows\system32)
for (j=0;j<iLen-1;j++)
{
if (szCompanyName)
if (strcmp("CompanyName",&Buf[j])==0)
strcpy(szCompanyName,&Buf[j+strlen("CompanyName")+2]);
if (szFileVersion)
{
if (strcmp("InternalName",&Buf[j])==0)
strcpy(szFileVersion,&Buf[j+strlen("InternalName")+1]);
if (strcmp("FileVersion",&Buf[j])==0)
strcpy(szTemp1,&Buf[j+strlen("FileVersion")+2]);
}
}
szFileVersion[strlen(szFileVersion)-4]='_';
szFileVersion[strlen(szFileVersion)-3]=0;
strcat(szFileVersion,szTemp1);
#if (!defined _WINDOWS) && (!defined _CONSOLE)
if (szCompanyName)
DbgPrint("szCompanyName=%s\n",szCompanyName);
if (szFileVersion)
DbgPrint("szFileVersion=%s\n",szFileVersion);
#endif
}
}//End of if (pIRDE->DataIsDirectory)
}//End of for (i=0;i <pIRD->
return 1;
}
int PE_Dump_Resource(char *pbuf,BYTE bRAWFile,
DWORD dwFirstIRD_Offset,
char *szCompanyName,
int iCompanyNameLen,
char *szFileVersion,
int iFileVersionLen,
PVA2RAW_REC pva2raw_rec)
{
DWORD dwDiff,dwAddr;
int i,iCount,iFixupCount;
PIMAGE_RESOURCE_DIRECTORY pIRD;
PIMAGE_RESOURCE_DIRECTORY_ENTRY pIRDE;
PIMAGE_RESOURCE_DIR_STRING_U prdsu;
if (PE_Head_Pointer(pbuf,&pIDH,&pINH,&pIFH,&pIOH,&pISH)<0)
return -1;
if (bRAWFile)
{
memset(&PE_va2raw_rec,0,sizeof(VA2RAW_REC));
//1:生成反向查找表
for (i=0;i<pIFH->NumberOfSections;i++)
{
PE_va2raw_rec[i].VA =(pISH+i)->VirtualAddress;
PE_va2raw_rec[i].VAEnd =(pISH+i)->VirtualAddress +(pISH+i)->Misc.VirtualSize;
PE_va2raw_rec[i].RAW =(pISH+i)->PointerToRawData;
PE_va2raw_rec[i].RAWEnd =(pISH+i)->PointerToRawData +(pISH+i)->Misc.VirtualSize;
}
}
if (pIOH->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size>0)
{
if (bRAWFile)
dwAddr=VA2RAW(pIOH->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress,PE_va2raw_rec);
else
dwAddr=pIOH->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
if (PE_Dump_Resource(pbuf,bRAWFile,dwAddr,
szCompanyName,iCompanyNameLen,szFileVersion,iFileVersionLen,
PE_va2raw_rec)<0 )
{
#if (!defined _WINDOWS) && (!defined _CONSOLE)
DbgPrint("PE_Dump_Resource error\n");
#endif
}
}
return 1;
}
当然，MSDN也介绍了API GetVersionInfo，但是笔者认为，既然是ARK，那么对于并不复杂的API，能自己实现的，还是自己实现为好。以下是GetVersionInfo的范例
void GetInternalName()
{
// Get the file version for the notepad.
FileVersionInfo^ myFileVersionInfo = FileVersionInfo::GetVersionInfo( "%systemroot%\\Notepad.exe" );
