Set IMAGE_FILE_*_RUN_FROM_SWAP flags for TC
Posted: 2020-11-06, 06:13 UTC
It seems that there are PE header flags that cause Windows to read entire executable to swap file when it is running from network or removable media (and do nothing for executables from local drives):
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP (0x0400)
IMAGE_FILE_NET_RUN_FROM_SWAP (0x0800)
I think these could be use useful for TC that is started from a network folder or USB stick, and I don't see any drawbacks. What do you think?
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP (0x0400)
IMAGE_FILE_NET_RUN_FROM_SWAP (0x0800)
I think these could be use useful for TC that is started from a network folder or USB stick, and I don't see any drawbacks. What do you think?