Detects whether buf contains a PE (Portable Executable) image by verifying the DOS MZ signature at offset 0 and the PE\0\0 signature at the offset indicated by e_lfanew (byte 0x3C).
buf
MZ
PE\0\0
e_lfanew
The binary buffer to inspect.
true if the buffer contains a valid PE image.
true
Detects whether
bufcontains a PE (Portable Executable) image by verifying the DOSMZsignature at offset 0 and thePE\0\0signature at the offset indicated bye_lfanew(byte 0x3C).