CryptSIPRetrieveSubjectGuid

　　CryptSIPRetrieveSubjectGuid根据文件类型检索SubjectGUID, 用于 CryptSIPLoad。

　　如果检索失败可以使用通用的 CRYPT_SUBJTYPE_FLAT_IMAGE;

　　GUID为{DE351A42-8E59-11D0-8C47-00C04FC295EE}

program CryptSIPRetrieveSubjectGuid;{$APPTYPE CONSOLE}usesWindows, SysUtils;/// ///
//
// CryptSIPRetrieveSubjectGuid (defined in crypt32.dll)
// ----------------------------------------------------------------------------
// looks at the file&＃39;s "Magic Number" and tries to determine which
// SIP&＃39;s object ID is right for the file type.
//
// Returns:
// TRUE: No fatal errors
// FALSE: Errors occured. See GetLastError()
//function _CryptSIPRetrieveSubjectGuid(FileName: LPCWSTR; // wide file namehFileIn: THandle; // or handle of open filepgSubject: PGUID // defined SIP&＃39;s GUID): BOOL; stdcall; external &＃39;crypt32.dll&＃39; name &＃39;CryptSIPRetrieveSubjectGuid&＃39;;varSubjectGuid: TGUID;
beginif ParamCount <1 thenbeginWriteLn(&＃39;1. 检索文件 "Magic Number"&＃39;);WriteLn(&＃39;2. Created 2011/12/19 by Hou&＃39;);WriteLn(&＃39;3. Command: App &＃39;);Exit;end;if not _CryptSIPRetrieveSubjectGuid(PWChar(WideString(ParamStr(ParamCount))),0,&＃64;SubjectGuid) thenbeginWriteLn(&＃39;Retrieve Fail!&＃39;);Exit;end;WriteLn(GUIDToString(SubjectGuid));
end.

附录&＃xff1a;

const// 根据Win2k泄漏的部分源码 mscdfapi.cpp &＃43; OllyICE makecat.exe获得(2011/12/20 by Hou)// http://mikolajapp.appspot.com/uuid/query?q&＃61;%7Bc689aaba-8e78-11d0-8c47-00c04fc295ee%7DCRYPT_SUBJTYPE_PE_IMAGE:TGUID &＃61; &＃39;{C689AAB8-8E78-11D0-8C47-00C04FC295EE}&＃39;;CRYPT_SUBJTYPE_JAVACLASS_IMAGE:TGUID &＃61; &＃39;{C689AAB9-8E78-11D0-8C47-00C04FC295EE}&＃39;;CRYPT_SUBJTYPE_CABINET_IMAGE:TGUID &＃61; &＃39;{C689AABA-8E78-11D0-8C47-00C04FC295EE}&＃39;;CRYPT_SUBJTYPE_FLAT_IMAGE:TGUID &＃61; &＃39;{DE351A42-8E59-11D0-8C47-00C04FC295EE}&＃39;;CRYPT_SUBJTYPE_CATALOG_IMAGE:TGUID &＃61; &＃39;{DE351A43-8E59-11D0-8C47-00C04FC295EE}&＃39;;CRYPT_SUBJTYPE_CTL_IMAGE:TGUID &＃61; &＃39;{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}&＃39;;