我試圖使用內存映射文件爲:使用MapViewOfFile有什麼限制嗎?
hFile = ::CreateFile(State.Path, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
0, OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN, 0);//open the file
if(hFile !=INVALID_HANDLE_VALUE){
hMap= ::CreateFileMapping(hFile, 0, PAGE_READONLY | SEC_COMMIT, 0, 0, 0);//create Mem mapping for the file in virtual memory
if(hMap!=NULL){
base = ::MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);//load the mapped file into the RAM
//start to compare some bytes (values) from mspaint.exe file in Win7
if(*((BYTE *)base + 0x1C3DF0)== 0x05)
i++;
if(*((BYTE *)base + 0x25250C)== 0x21)
i++;
if(*((BYTE *)base + 0x25272A)== 0x97)
i++;
if(i==3){
// the file is malicious
}
一旦文件大小是千兆字節的MapViewOfFile
功能停止工作,並申請將被崩潰!使用MapViewOfFile
有什麼限制嗎?任何建議?