PHP Judge exe file is normal _php tutorial

PHP to determine if EXE file is normal

Include "exeinfo.php";
$pe = new Pe_viewer (' cmd.exe ');
$pe->out ();
?>

, usually the virus will shell, after the shell of the program its section name is no longer common. Text,. Data,. Rdata,. rsrc, etc., but a section name that contains characters such as UPX, Aspack, and so on;
2, usually the entry point of the program at 100,001, most of the 1000 slightly more places, if the program entry point value is too large, it is questionable;
3, analysis of the import table, usually the Virus KERNEL32.DLL import table only LoadLibrary, GetProcAddress and other few functions.
Of course, the above judgments are inaccurate, and some hacking procedures and procedures that require secrecy will also be added to the shell.
This script can get the basic information of EXE file and output in XML format, and currently does not include the introduction table information. You can view the output information to determine if the EXE file is normal.

http://www.bkjia.com/PHPjc/629749.html www.bkjia.com true http://www.bkjia.com/PHPjc/629749.html techarticle php determine exe file is normal? PHP include exeinfo.php; $pe = new Pe_viewer (' cmd.exe '); $pe-out ();?, usually the virus will shell, the shell of the program its section name is no longer common. T.. .

