判断文件的最后修改时间就可以了!
function GetFileLastModiTime(FileName: string): string;
var
hFile: Thandle;
WriteTime, LocalTime: TFILETIME;
DosFileTime: DWORD; // holds the Dos date and time
SystemTime: TSystemTime; // holds the last modification time
begin
hfile := CreateFile(pchar(FileName),
0,
FILE_SHARE_READ,
nil,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
0);
if hFile = INVALID_HANDLE_VALUE then
begin
ShowMessage('Error Opening File');
Exit;
end;
GetFileTime(hFile, nil, nil, @WriteTime);
FileTimeToLocalFileTime(WriteTime, LocalTime);
FileTimeToSystemTime(LocalTime, SystemTime); {convert the file time into Dos date and time components...}
FileTimeToDosDateTime(LocalTime, LongRec(DosFileTime).Hi, LongRec(DosFileTime).Lo);
Result := Datetimetostr(FileDateToDateTime(DosFileTime));
end;
function GetFileLastModiTime(FileName: string): string;
var
hFile: Thandle;
WriteTime, LocalTime: TFILETIME;
DosFileTime: DWORD; // holds the Dos date and time
SystemTime: TSystemTime; // holds the last modification time
begin
hfile := CreateFile(pchar(FileName),
0,
FILE_SHARE_READ,
nil,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
0);
if hFile = INVALID_HANDLE_VALUE then
begin
ShowMessage('Error Opening File');
Exit;
end;
GetFileTime(hFile, nil, nil, @WriteTime);
FileTimeToLocalFileTime(WriteTime, LocalTime);
FileTimeToSystemTime(LocalTime, SystemTime); {convert the file time into Dos date and time components...}
FileTimeToDosDateTime(LocalTime, LongRec(DosFileTime).Hi, LongRec(DosFileTime).Lo);
Result := Datetimetostr(FileDateToDateTime(DosFileTime));
end;
CIH病毒源码里有!就是给PE文件打标记的!
up 有分吗?
不过有可能破坏这个文件
因此,如果可行的话,把你修改过的文件的保存到一个配置文件或StringList中去,需要的时候可以进行检索
最后别忘了加分给我呦!