Everything 1.5.0.1388a adds READUINT32() to formulas.
To show if exe files have a PE header:
Windows executables will have a PE header.
DOS executables will not have a PE header.
To search for PE exe files: (Windows executables)
To search for exe files without a PE header: (DOS executables)
To show if exe files have a PE header:
*.exe add-column:a a-label:PE a:=IF(READUINT32($filename:,READUINT32($filename:,0x3c))==0x00004550,"true","false")Windows executables will have a PE header.
DOS executables will not have a PE header.
To search for PE exe files: (Windows executables)
*.exe READUINT32($filename:,READUINT32($filename:,0x3c))==0x00004550To search for exe files without a PE header: (DOS executables)
*.exe READUINT32($filename:,READUINT32($filename:,0x3c))!=0x00004550Statistics: Posted by void — Thu Dec 12, 2024 5:07 am