Page 1 of 1

Set IMAGE_FILE_*_RUN_FROM_SWAP flags for TC

Posted: 2020-11-06, 06:13 UTC
by MVV
It seems that there are PE header flags that cause Windows to read entire executable to swap file when it is running from network or removable media (and do nothing for executables from local drives):
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP (0x0400)
IMAGE_FILE_NET_RUN_FROM_SWAP (0x0800)

I think these could be use useful for TC that is started from a network folder or USB stick, and I don't see any drawbacks. What do you think?

Re: Set IMAGE_FILE_*_RUN_FROM_SWAP flags for TC

Posted: 2020-11-06, 14:27 UTC
by ghisler(Author)
Sounds useful - any drawback, like not starting from Windows 9x or so?

Re: Set IMAGE_FILE_*_RUN_FROM_SWAP flags for TC

Posted: 2020-11-06, 17:58 UTC
by MVV
I think you should try them to see, I haven't used them.