添加项目文件。

Etw Syscall/libpeconv-master/tests/test_format_detect.cpp

@@ -0,0 +1,47 @@
+#include "test_format_detect.h"
+
+using namespace peconv;
+
+void printFromat(bool isRaw)
+{
+    if (isRaw) {
+        std::cout << "PE is in the RAW format\n";
+    }
+    else {
+        std::cout << "PE is in the VIRTUAL format\n";
+    }
+}
+
+int tests::check_pe_format(const char *my_path)
+{
+    size_t pe_size = 0;
+    std::cout << "Module: " << my_path << "\n";
+    // Load the current executable from the file with the help of libpeconv:
+    BYTE* loaded_pe = peconv::load_file(my_path, pe_size);
+    if (!loaded_pe) {
+        std::cout << "Loading failed!\n";
+        return -1;
+    }
+    bool isRaw = peconv::is_pe_raw(loaded_pe, pe_size);
+    bool isRaw2 = false;
+    if (isRaw) {
+        size_t v_size = 0;
+        BYTE* virtual_pe = peconv::load_pe_module(my_path, v_size, false, false);
+        if (!virtual_pe) {
+            std::cout << "Mapping failed!\n";
+            return -1;
+        }
+        isRaw2 = peconv::is_pe_raw(virtual_pe, v_size);
+        peconv::free_pe_buffer(virtual_pe);
+    }
+    peconv::free_pe_buffer(loaded_pe);
+
+    std::cout << "Test 1:\n\t";
+    printFromat(isRaw);
+    std::cout << "Test 2:\n\t";
+    printFromat(isRaw2);
+    if (isRaw && !isRaw2) {
+        return 0; // status OK
+    }
+    return 1;
+}