windows 更改二进制文件的校验和
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/2744199/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Changing checksum of a binary
提问by anand
How to modify checksum of a binary?
Specifically, I want to edit embedded checksum in a dll/exe.
Are there any tools available?
如何修改二进制文件的校验和？
具体来说，我想在 dll/exe 中编辑嵌入式校验和。
有没有可用的工具？
回答by Anders
Windows only requires the checksum to be != 0 for kernel modules, you don't need to set it for usermode modules. If you really want to set the checksum, run EDITBIN /RELEASE yourapp.exe, or call CheckSumMappedFile(). See this articlefor an analysis of the checksum algorithm.
Windows 只要求内核模块的校验和为 != 0，您不需要为用户模式模块设置它。如果您确实要设置校验和，请运行 EDITBIN /RELEASE yourapp.exe，或调用CheckSumMappedFile()。有关校验和算法的分析，请参阅本文。
回答by NeuroScr
You can use a "hex editor" to modify a dll/exe, but unless you know how to reverse calculate your checksum, its not going to be much help.
您可以使用“十六进制编辑器”来修改 dll/exe，但除非您知道如何反向计算校验和，否则它不会有太大帮助。
回答by Vicky
OK, this link gives you the file format of Windows DLLs/Executables: http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf
好的，此链接为您提供了 Windows DLL/可执行文件的文件格式：http: //www.openrce.org/reference_library/files/reference/PE%20Format.pdf
You can see there are several possible palces in the headers were checksums can be stored, some of which are optional, so you'd need to parse the image to find out what's in there. There are tools like Python PE parsers (google for options) to help with this.
您可以看到标题中有几个可能的位置可以存储校验和，其中一些是可选的，因此您需要解析图像以找出其中的内容。有像 Python PE 解析器（谷歌搜索选项）这样的工具来帮助解决这个问题。
Once you know which bytes you want to change, pick a hex editor and do it. You can even edit binaries in Visual Studio.
一旦您知道要更改哪些字节，请选择一个十六进制编辑器并进行更改。您甚至可以在 Visual Studio 中编辑二进制文件。
[Edit: But, as I commented above, I think Windows might barf on it if it doesn't match the expected value]
[编辑：但是，正如我上面评论的那样，如果它与预期值不匹配，我认为 Windows 可能会拒绝它]
