diff options
| author | op2786 <op2786@proton.me> | 2022-10-31 09:18:50 +0100 |
|---|---|---|
| committer | Xusheng <xusheng@vector35.com> | 2023-01-05 16:20:51 +0800 |
| commit | 69e95dfa4617e4257a8b021eae8184c2f0fcbbd9 (patch) | |
| tree | fcb64f6d6457b5cdf081f73fea07fce9183de658 /examples/triage/headers.cpp | |
| parent | 6afd790abeccc98e4319e392ed1f8d8dd78baa8f (diff) | |
fix for outdated addresses after rebasing in triage view
Diffstat (limited to 'examples/triage/headers.cpp')
| -rw-r--r-- | examples/triage/headers.cpp | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/examples/triage/headers.cpp b/examples/triage/headers.cpp index 40775b61..20332527 100644 --- a/examples/triage/headers.cpp +++ b/examples/triage/headers.cpp @@ -151,12 +151,13 @@ PEHeaders::PEHeaders(BinaryViewRef data) AddField("Timestamp", t.toString()); AddField("Timestamp (Hex)", QString::number(secs, 16).prepend("0x")); - AddField("Current Base", QString("0x") + QString::number(data->GetStart(), 16), AddressHeaderField); + uint64_t currentBase = data->GetStart(); + AddField("Current Base", QString("0x") + QString::number(currentBase, 16), AddressHeaderField); uint64_t base = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "imageBase"); AddField("Image Base", QString("0x") + QString::number(base, 16), AddressHeaderField); - uint64_t entryPoint = base + GetValueOfStructMember(data, optHeaderName, optHeaderStart, "addressOfEntryPoint"); + uint64_t entryPoint = currentBase + GetValueOfStructMember(data, optHeaderName, optHeaderStart, "addressOfEntryPoint"); AddField("Entry Point", QString("0x") + QString::number(entryPoint, 16), CodeHeaderField); uint64_t sectionAlign = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "sectionAlignment"); @@ -168,12 +169,12 @@ PEHeaders::PEHeaders(BinaryViewRef data) uint64_t checksum = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "checkSum"); AddField("Checksum", QString("0x") + QString::number(checksum, 16)); - uint64_t codeBase = base + GetValueOfStructMember(data, optHeaderName, optHeaderStart, "baseOfCode"); + uint64_t codeBase = currentBase + GetValueOfStructMember(data, optHeaderName, optHeaderStart, "baseOfCode"); AddField("Base of Code", QString("0x") + QString::number(codeBase, 16), AddressHeaderField); if (!is64bit) { - uint64_t dataBase = base + GetValueOfStructMember(data, optHeaderName, optHeaderStart, "baseOfData"); + uint64_t dataBase = currentBase + GetValueOfStructMember(data, optHeaderName, optHeaderStart, "baseOfData"); AddField("Base of Data", QString("0x") + QString::number(dataBase, 16), AddressHeaderField); } |