NAME¶

ImageGetDigestStream (IMAGEHLP.@)

SYNOPSIS¶

BOOL ImageGetDigestStream
(
HANDLE FileHandle,
DWORD DigestLevel,
DIGEST_FUNCTION DigestFunction,
DIGEST_HANDLE DigestHandle
)

DESCRIPTION¶

Gets a stream of bytes from a PE file over which a hash might be computed to verify that the image has not changed. Useful for creating a certificate to be added to the file with ImageAddCertificate.

PARAMS¶

FileHandle [In] File for which to return a stream. DigestLevel [In] Flags to control which portions of the file to return. 0 is allowed, as is any combination of: CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO: reports the entire import section rather than selected portions of it. CERT_PE_IMAGE_DIGEST_DEBUG_INFO: reports the debug section. CERT_PE_IMAGE_DIGEST_RESOURCES: reports the resources section. DigestFunction [In] Callback function. DigestHandle [In] Handle passed as first parameter to DigestFunction.

RETURNS¶

TRUE if successful. FALSE if unsuccessful. GetLastError returns more about the error.

NOTES¶

Only supports 32-bit PE files, not tested with any other format. Reports data in the following order: 1. The file headers are reported first 2. Any code sections are reported next. 3. The data ( ".data" and ".rdata") sections are reported next. 4. The import section is reported next. 5. If CERT_PE_IMAGE_DIGEST_DEBUG_INFO is set in DigestLevel, the debug section is reported next. 6. If CERT_PE_IMAGE_DIGEST_RESOURCES is set in DigestLevel, the resources section is reported next.

BUGS¶

CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO must be specified, returns an error if not.

IMPLEMENTATION¶

Declared in "imagehlp.h". Implemented in "dlls/imagehlp/integrity.c". Debug channel "imagehlp".