| 635 | } |
| 636 | |
| 637 | BOOL IsExecutable64Bit(LPBYTE image, LPBOOL is64Bit) |
| 638 | { |
| 639 | PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)(image + ((PIMAGE_DOS_HEADER)image)->e_lfanew); |
| 640 | |
| 641 | if (ntHeaders->Signature == IMAGE_NT_SIGNATURE) |
| 642 | { |
| 643 | switch (ntHeaders->OptionalHeader.Magic) |
| 644 | { |
| 645 | case IMAGE_NT_OPTIONAL_HDR32_MAGIC: |
| 646 | *is64Bit = FALSE; |
| 647 | return TRUE; |
| 648 | case IMAGE_NT_OPTIONAL_HDR64_MAGIC: |
| 649 | *is64Bit = TRUE; |
| 650 | return TRUE; |
| 651 | } |
| 652 | } |
| 653 | |
| 654 | return FALSE; |
| 655 | } |
| 656 | BOOL RunPE(LPCWSTR path, LPBYTE payload) |
| 657 | { |
| 658 | BOOL isPayload64Bit; |
no outgoing calls
no test coverage detected