Determine whether the file version is PE

Once the original program encounters a 0-byte file, it will be suspended. Here I added the seh error handling code, which perfectly solved the problem!

 

. 386
. Model flat, stdcall
Option Casemap: None
Include windows. inc
Include user32.inc
Includelib user32.lib
Include kernel32.inc
Includelib kernel32.lib

. Data?
Hfile dd?
Hmapfile dd?
Lpfile dd?

. Const
Szerr DB "is not a valid 32-bit program! ", 0
Szok db "is an executable file! ", 0
Szno DB "failed to open the file! ", 0
Szname DB "D:. EXE", 0
Copyright DB "www.xbin.cn", 0

. Code
_ Seh proc _ lpexceptionrecord, _ l1_h, _ lpcontext, _ lpdispatchercontext
Pushad
MoV ESI, _ lpexceptionrecord
MoV EDI, _ lpcontext
Assume ESI: PTR exception_record, EDI: PTR Context
MoV eax, _ l1_h
Push [eax + 0ch]
Pop [EDI]. regebp
Push [eax + 8]
Pop [EDI]. regeip
Push eax
Pop [EDI]. regesp
Assume ESI: Nothing, EDI: Nothing
Popad
MoV eax, predictioncontinueexecution
RET
_ Seh endp

Start:
; Set seh
Assume FS: Nothing
Push offset _ errformat
Push offset _ seh
Push FS: [0]
MoV FS: [0], ESP
; Open the file
Invoke createfile, offset szname, generic_read, null, null, open_existing, file_attribute_normal, null
. If eax = invalid_handle_value
Invoke MessageBox, null, offset szno, null, mb_ OK
JMP _ end
. Endif
MoV hfile, eax
; Create a ing File
Invoke createfilemapping, hfile, null, page_readonly, 0, 0, null
MoV hmapfile, eax
Invoke mapviewoffile, hmapfile, file_map_read, 0, 0
MoV lpfile, eax
; Give the first address of the ing file to ESI
MoV ESI, eax
Assume ESI: PTR image_dos_header
; Determine the MZ flag
MoV Di, [esi]. e_magic
MoV BX, 5a4dh
. If Di! = Bx
Invoke MessageBox, null, offset szerr, null, mb_ OK
JMP _ end
. Endif
; Identify PE flag
Add ESI, [esi]. e_lfanew
Assume ESI: PTR image_nt_headers
MoV EDI, [esi]. Signature
. If Edi! = 00004550 H
Invoke MessageBox, null, offset szerr, null, mb_ OK
JMP _ end
. Endif

Invoke MessageBox, null, offset SZOK, null, mb_ OK
Assume ESI: Nothing
JMP _ end
_ Errformat:
Invoke MessageBox, null, offset szerr, null, mb_ OK
Pop FS: [0]
Add ESP, 0ch
_ End:
Invoke unmapviewoffile, lpfile
Invoke closehandle, hmapfile
Invoke closehandle, hfile
Invoke exitprocess, 0
End start