I need help with File.Read() function

[Ovg]

I am trying to read first six bytes of PE header (PE\x00\x00L\x01 or PE\x00\x00d†)

Code: Select all

Filename := "C:\windows\system32\kernel32.dll"
Header := "000000"
Content := "Unknown"
File := FileOpen(Filename,"r")
File.Seek(0x3C,0)
Address := File.ReadUInt()
File.Seek(Address-0x3c-4,1)
Header := File.Read(6)

Only two bytes ("PE") actually is read. What is wrong?
I have noticed that only File.Read(256) actually read 256 bytes in this case,
any call File.Read() with number less than 256 reads only two bytes.
Am I missing something?

AHK U v 1.1.25.1

[4GForce]

Only two bytes ("PE") actually is read. What is wrong?
I have noticed that only File.Read(256) actually read 256 bytes in this case,
any call File.Read() with number less than 256 reads only two bytes.
Am I missing something?

Actually it works but the nul characters are breaking the string.
There is probably a more simple way to handle this like FileRead *c

Code: Select all

#singleinstance force

Filename := "C:\windows\system32\kernel32.dll"
Header := "000000"
Content := "Unknown"
File := FileOpen(Filename,"r")
File.Seek(0x3C,0)
Address := File.ReadUInt()
File.Seek(Address-0x3c-4,1)
SetFormat Integer, H
str := ""
loop 6
{
	char := File.Read(1)
	Transform charValue, Asc, % char
	if(!charValue) {
		charValue := 0x00
	}
	if(charValue > 31) {
		str .= char
	}
	else {
		str .= "\" . charValue
	}
}
msgbox % str
File.Close()

[Ovg]

24GForce
Thank you very much for reply and example!

... the nul characters are breaking the string ...

Aha, I suspected this, but wasn't sure.
But why \x00 doesn't break string when call File.Read(256)?
In my case I think it would be simpler to read 256 byte and then

Code: Select all

If RegExMatch(Header, "PE\x00\x00L\x01")
  Content := "x86"
Else If RegExMatch(Header, "PE\x00\x00d†")
  Content := "x64"

[4GForce]

Aha, I suspected this, but wasn't sure.
But why \x00 doesn't break string when call File.Read(256)?
In my case I think it would be simpler to read 256 byte and then

Not sure, even when I tried Read(256) all I got is 'PE' ( but the StrLen is 256 )
I tried a few things with RawRead but no success there either.
Like I said, there has to be a better way but I don't know it.

[Ovg]

I tried RawRead too, no luck ....
This code working like a charm for me (Many thanks to jNizM https://autohotkey.com/boards/viewtopic.php?f=5&t=28681)

Code: Select all

Type := {0 : "x86", 1: "Dos", 2: "Win16", 3: "Pif", 4: "POSIX", 5: "OS/216", 6: "x64"}
SplitPath, Filename,,, Ext
StringLower, Ext, Ext
FileGetVersion, Content, %Filename%
Content1 := "Unknown"
Header := ""
If Ext = exe
{
  If DllCall("GetBinaryTypeW", "str", Filename, "uint*", BinaryType)
    Content1 := Type[BinaryType]
}
Else
{
  File := FileOpen(Filename, "r")
  Header := File.Read(384)
  If RegExMatch(Header, "PE\x00\x00L\x01")
     Content1 := "x86"
  Else If RegExMatch(Header, "PE\x00\x00d†")
     Content1 := "x64"
}