Windows PE可执行文件CRC计算问题
让我解释一下我想要实现的目标。我想从我的 Windows 可执行文件内部知道它在构建后是否被篡改。为此，我决定从内部计算其自己的文件的 CRC 值，并将其与预定义值进行比较。但我遇到的是，一旦构建了可执行文件，CRC 就会保持不变，但直到我再次重新构建它（不对源代码进行任何更改）。这就是 CRC 发生变化的时候。这里有什么魔力？编译器是否会向 exe 文件添加一些任意字节？
附言。我正在使用 Microsoft Visual Studio C++ 2008 并在 Windows 7 Ultimate 上运行我的测试。
Let me explain what I'm trying to accomplish. I want to know from inside my Windows executable file if it was tampered with after it was built. For that I decided to calculate the CRC value on its own file from within and compare it with a predefined value. But what I'm encountering is that once the executable is built the CRC remains the same, but only until I re-build it again (without any changes done to the source code). That's when the CRC changes. What is the magic here? Does the compiler add some arbitrary bytes to the exe file?
PS. I'm using Microsoft Visual Studio C++ 2008 and run my tests on Windows 7 Ultimate.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
它可能是编译器/链接器自动嵌入的一些时间戳或版本号...
为了解释这一点，我建议一些不同的东西（基于这些是本机 EXE/DLL 的事实）：
只需对生成的文件进行后处理 - don在生成结果文件之前，不要对结果文件的 CRC32 进行任何假设...
Windows 在加载 EXE/DLL 时有一个非常“好的”功能：它只是忽略文件末尾不属于那里的任何内容。
您可以利用这一点：将一个字节块（例如 256 字节）附加到文件中。该块可以包含您喜欢的任何内容（文件的哈希值、文件的长度等），甚至可以加密...当您想要检查时，您可以计算所需的信息（例如您的 CRC...）并将其与你的文件的那个块...
为了让它变得更难，你可以包含不同的哈希值并随机选择你检查的一个...你甚至可以在该块中撒一些随机字节...
还要进行一项检查，确保仅存在一个这样的块...这样，如果没有这样的块、多个这样的块或您的检查并且该块中保存的信息不存在，您可以中止或执行任何您想要的操作匹配。
It could be some timestamp or version number automatically embedded by the compiler/linker...
To account for that I suggest something different (based on the fact that these are native EXE/DLLs):
Just postprocess the generated file - don't assume anything about CRC32 of the resulting file before it is generated...
Windows has a really "nice" feature when loading an EXE/DLL: it just ignores anything at the end of the file that doesn't belong there.
You can use this to your advantage: append a block of bytes (for example 256 bytes) to the file. This block can contain whatever you like (hash of your file, length of your file etc.) and can be even encrypted... when you want to check you calculate the information needed (like your CRC...) and compare it to that block of your file...
To make it harder you can include different hashes and choose randomly which one you check... you can even sprinkle some random bytes into that block...
Also put in a check that makes sure there is only one such block present... so you can abort or whatever you want if there is no such block, more than one such block or your check and the saved information from that block does not match.
您考虑过使用数字签名吗？签名可以在编译后应用，并允许您验证 EXE 是否未被编辑。这是一个完美的案例。
您可以使用"SignTool.EXE" 对您的 EXE 进行签名。
要验证您可以使用以下位置的代码：
验证可执行文件是否是否已签名（signtool 用于对该 exe 进行签名）
我相信您必须购买代码签名证书（如果您希望它得到完全验证）。我认为 GoDaddy 提供最便宜的证书（目前）。我还听说，如果你有一个开源项目，你也许可以获得免费的签名证书。来自一些权威机构。
Have you considered using a digital signature? The signature can be applied after compilation, and allows you to verify that the EXE has not been edited. This a perfect case for one.
You can use "SignTool.EXE" to sign your EXE.
To verify you can use the code found at:
Verify whether an executable is signed or not (signtool used to sign that exe)
I believe you would have to purchase a Code Signing Certificate (if you want it fully validated). I think GoDaddy provides the least expensive ones (right now). I have also heard that if you have an open source project, you may be able to obtain a free signing Cert. from some authorities.