search

unknownv2 / CoreHook

A library that simplifies intercepting application function calls using managed code and the .NET Core runtime
MIT License
259 stars 40 forks source link

Update how to determine the PE image type #122

Closed unknownv2 closed 5 years ago

unknownv2 commented 5 years ago

The PE optional header has an image magic type we can use to determine whether the image is 32-bit or 64-bit, so use that instead of the file header machine ID.