Php checks whether the exe file is normal

 

Php checks whether the exe file is normal

<? Php
Include "ExeInfo. php ";
$ Pe = new PE_VIEWER ('cmd.exe ');
$ Pe-> out ();
?>

Normally, the virus is shelled. The node names of programs after shelling are no longer common. text,. data,. rdata,. rsrc, etc., but the node names that contain characters such as UPX and Aspack;
2. Generally, the entry point of a program is 10000, and most of them are a little more than 1000. If the value of the program entry point is too large, it is doubtful;
3. Analyze the import table. Generally, the virus KERNEL32.DLL import table only has a few functions, such as LoadLibrary and GetProcAddress.
Of course, the above judgment is not accurate. Some hacker programs and programs that require confidentiality will also be shelled.
This script can obtain the basic information of the exe file and output it in xml format. Currently, table information is not included. You can view the output information to determine whether the exe file is normal.