DLL prüfen

[DieDolly]

Ups. Richtig. Stream hinzugefügt aber den alten nicht gelöscht

Hier nochmal alles richtig mit überladenen Prozeduren

Delphi-Quellcode:

function Isx64(const Strm: TStream): Boolean; overload;
const
 IMAGE_FILE_MACHINE_I386 = $014C; // Intel x86
 IMAGE_FILE_MACHINE_IA64 = $0200; // Intel Itanium Processor Family (IPF)
 IMAGE_FILE_MACHINE_AMD64 = $8664; // x64 (AMD64 or EM64T)
 // You'll unlikely encounter the things below:
 IMAGE_FILE_MACHINE_R3000_BE = $160; // MIPS big-endian
 IMAGE_FILE_MACHINE_R3000 = $162; // MIPS little-endian, 0x160 big-endian
 IMAGE_FILE_MACHINE_R4000 = $166; // MIPS little-endian
 IMAGE_FILE_MACHINE_R10000 = $168; // MIPS little-endian
 IMAGE_FILE_MACHINE_ALPHA = $184; // Alpha_AXP }
 IMAGE_FILE_MACHINE_POWERPC = $1F0; // IBM PowerPC Little-Endian
var
 Header: TImageDosHeader;
 ImageNtHeaders: TImageNtHeaders;
begin
 Strm.ReadBuffer(Header, SizeOf(Header));
 if (Header.e_magic <> IMAGE_DOS_SIGNATURE) or (Header._lfanew = 0) then
  raise Exception.Create('Invalid executable');
 Strm.Position := Header._lfanew;

 Strm.ReadBuffer(ImageNtHeaders, SizeOf(ImageNtHeaders));
 if ImageNtHeaders.Signature <> IMAGE_NT_SIGNATURE then
  raise Exception.Create('Invalid executable');

 Result := ImageNtHeaders.FileHeader.Machine <> IMAGE_FILE_MACHINE_I386;
end;

function Isx64(const FileName: string): Boolean; overload;
var
 MemoryStream: TMemoryStream;
begin
 MemoryStream := TMemoryStream.Create;
 try
  MemoryStream.LoadFromFile(FileName);
  Result := Isx64(MemoryStream);
 finally
  MemoryStream.Free;
 end;
end;