Search code examples
windowswinapiportable-executable

Loading a PE File and Launching it, how to capture the exit/return code


I'm manually (in code that is) loading in a windows PE file and executing it succesfully with a call to its entry point as defined in the structure "IMAGE_NT_HEADERS32". However as this value is a void returned function how do we 'read' the exit/return code that it provides?

i.e. when i call this (which is the PE file's entry point)

((void(*)(void))EntryAddr)();

Where does it place/put the exit code from its 'int main(...)' or 'int winmain(...)' call?

Thanks in advance.

Edit: For clarification (see comments below). My Application loads an exe directly into memory using VirtualAllocEx and not any NtCreateProcess methods.


Solution

  • With thanks to "Eryk Sun" above, his solution was correct and this code does in fact work..

    // call the entry point :: here we assume that everything is ok.
    ((void(*)(void))EntryAddr)();
    
    DWORD exit;
    GetExitCodeProcess(GetModuleHandle(NULL), &exit);