Alexandre:
Look at line 114 of my code: http://dpaste.com/3B5WYGV
The indentations are messed up.
peh.Signature = ('\0' << 8) + ('\0' << 8) + ('E' << 8) + 'P';
You need shifts 8, 16, 24...
alias PIMAGE_DOS_HEADER = IMAGE_DOS_HEADER*;
I don't see much need for such aliases.
auto peh = cast(PIMAGE_NT_HEADERS32)&image[0x80];
I suggest to avoid magic constants like that 0x80, like I have avoided it here:
memcpy(&image[IMAGE_DOS_HEADER.sizeof], Bye, bearophile
