| 53 | return result; |
| 54 | } |
| 55 | VOID RemoveR77Header() |
| 56 | { |
| 57 | LPBYTE module = (LPBYTE)GetModuleHandleW(NULL); |
| 58 | if (module) |
| 59 | { |
| 60 | LPWORD signaturePtr = (LPWORD) & module[R77_HEADER_OFFSET]; |
| 61 | |
| 62 | DWORD oldProtect; |
| 63 | if (VirtualProtect(signaturePtr, 10, PAGE_READWRITE, &oldProtect)) |
| 64 | { |
| 65 | // Remove the r77 header by overwriting the signature in the DOS header. |
| 66 | *(LPWORD)&module[R77_HEADER_OFFSET] = 0; |
| 67 | *(PDWORD64)&module[R77_HEADER_OFFSET + 2] = 0; |
| 68 | |
| 69 | VirtualProtect(signaturePtr, 10, oldProtect, &oldProtect); |
| 70 | } |
| 71 | } |
| 72 | } |
no outgoing calls
no test coverage detected