Is Valid IMAGE_DOS_SIGNATURE

Question

I want to check a file has a valid IMAGE_DOS_SIGNATURE (MZ)

function isMZ(FileName : String) : boolean;
var
 Signature: Word;
 fexe: TFileStream;
begin
result:=false;
try
  fexe := TFileStream.Create(FileName, fmOpenRead or fmShareDenyNone);
  fexe.ReadBuffer(Signature, SizeOf(Signature));
  if Signature = $5A4D { 'MZ' } then
  result:=true;
finally
fexe.free;
end;
end;

I know I can use some code in Windows unit to check the IMAGE_DOS_SIGNATURE. The problem is I want the fastest way to check IMAGE_DOS_SIGNATURE (for a big file). I need your some suggestion about my code or maybe a new code?

Thanks

Answer 1

The size of the file doesn't matter because your code only reads the first two bytes.

Any overhead from allocating and using a TFileStream, which goes through SysUtils.FileRead before reaching Win32 ReadFile, ought to be all but invisible noise compared to the cost of seeking in the only situation where it should matter, where you're scanning through hundreds of executables.

There might possibly be some benefit in tweaking Windows' caching by using the raw WinAPI, but I would expect it to be very marginal.