diff options
| author | Xusheng <xusheng@vector35.com> | 2021-09-27 12:35:31 +0800 |
|---|---|---|
| committer | Xusheng <xusheng@vector35.com> | 2021-09-27 12:35:31 +0800 |
| commit | bcfb2df84b1c08471317809f2fe4436bf910230d (patch) | |
| tree | 84cae30a44f799ef9d0648ede23bd2155fede553 | |
| parent | c7e33d35b4adef40e53619662c7a6cfc198efd4a (diff) | |
Show endianness information in the triage view
| -rw-r--r-- | examples/triage/headers.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/examples/triage/headers.cpp b/examples/triage/headers.cpp index ee44bc75..325dbe8c 100644 --- a/examples/triage/headers.cpp +++ b/examples/triage/headers.cpp @@ -78,6 +78,7 @@ GenericHeaders::GenericHeaders(BinaryViewRef data) AddField("Entry Point", QString("0x") + QString::number(data->GetEntryPoint(), 16), CodeHeaderField); if (data->IsValidOffset(data->GetStart())) AddField("Current Base", QString("0x") + QString::number(data->GetStart(), 16), AddressHeaderField); + AddField("Endianness", data->GetDefaultEndianness() == BigEndian ? "Big" : "Little"); } @@ -117,6 +118,8 @@ PEHeaders::PEHeaders(BinaryViewRef data) machineName = machineName.mid((int)strlen("IMAGE_FILE_MACHINE_")); AddField("Machine", machineName); + AddField("Endianness", data->GetDefaultEndianness() == BigEndian ? "Big" : "Little"); + uint64_t subsysValue = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "subsystem"); QString subsysName = GetNameOfEnumerationMember(data, "pe_subsystem", subsysValue); if (subsysName.startsWith("IMAGE_SUBSYSTEM_")) |