[ more.. | less.. ]

#define MakePtr( cast, ptr, addValue ) (cast)( (DWORD_PTR)(ptr) + (DWORD_PTR)(addValue))

int main(int argc, char* argv[])
{
    char    *filename   = NULL;
    HANDLE hFile;
    HANDLE hFileMapping;
    PIMAGE_DOS_HEADER dosHeader;
    PBYTE g_pMappedFileBase = 0;

    if(argc != 2)   
    {   
        cout << "WhatEXE.exe [대상파일명]" << endl;
        exit(0);
    } 
    filename = argv[1];

    hFile = CreateFile(filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);

    if ( hFile == INVALID_HANDLE_VALUE )
    {
        cout << "CreateFile() fail" << endl;
        return 0;
    }

    hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
    if ( hFileMapping == 0 )
    {
        CloseHandle(hFile);
        cout << "CreateFileMapping() fail " << endl;
        return 0;
    }

    g_pMappedFileBase = (PBYTE)MapViewOfFile(hFileMapping,FILE_MAP_READ,0,0,0);
    if ( g_pMappedFileBase == 0 )
    {
        CloseHandle(hFileMapping);
        CloseHandle(hFile);
        cout << "MapViewOfFile() fail" << endl;
        return 0;
    }

    dosHeader = (PIMAGE_DOS_HEADER)g_pMappedFileBase;
    PIMAGE_FILE_HEADER pImgFileHdr = (PIMAGE_FILE_HEADER)g_pMappedFileBase;

    if ( dosHeader->e_magic == IMAGE_DOS_SIGNATURE )
    {
        PIMAGE_NT_HEADERS pNTHeader;
        PBYTE pImageBase = (PBYTE)dosHeader;

        // Make pointers to 32 and 64 bit versions of the header.
        pNTHeader = MakePtr( PIMAGE_NT_HEADERS, dosHeader, dosHeader->e_lfanew );

        // First, verify that the e_lfanew field gave us a reasonable
        // pointer, then verify the PE signature.
        if ( IsBadReadPtr( pNTHeader, sizeof(pNTHeader->Signature) ) )
        {
            cout << "Not EXE" << endl;
            return 0;
        }

        if ( pNTHeader->Signature != IMAGE_NT_SIGNATURE )
        {
            cout << "Not EXE" << endl;
            return 0;
        }

        char *s;
        UINT width = 30;

        switch( pNTHeader->OptionalHeader.Subsystem )
        {
        case IMAGE_SUBSYSTEM_UNKNOWN: s = "UNKNOWN (0)"; break;
        case IMAGE_SUBSYSTEM_NATIVE: s = "Native"; break;
        case IMAGE_SUBSYSTEM_WINDOWS_GUI: s = "Windows GUI"; break;
        case IMAGE_SUBSYSTEM_WINDOWS_CUI: s = "Windows character"; break;
        case IMAGE_SUBSYSTEM_OS2_CUI: s = "OS/2 character"; break;
        case IMAGE_SUBSYSTEM_POSIX_CUI: s = "Posix character"; break;
        case IMAGE_SUBSYSTEM_NATIVE_WINDOWS: s = "Native Windows (Win9X driver)"; break;
        case IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: s = "Windows CE GUI"; break;
        case IMAGE_SUBSYSTEM_EFI_APPLICATION: s = "EFI_APPLICATION"; break;
        case IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: s = "EFI_BOOT_SERVICE_DRIVER"; break;
        case IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: s = "EFI_RUNTIME_DRIVER"; break;
        case IMAGE_SUBSYSTEM_EFI_ROM: s = "EFI_ROM";
        case IMAGE_SUBSYSTEM_XBOX: s = "XBOX";
        default: s = "unknown";
        }
        cout << filename << "    " << "Subsystem" << "    " <<
                      pNTHeader->OptionalHeader.Subsystem << "    " << s;
    }