diff options
| author | Jordan Wiens <github@psifertex.com> | 2025-12-19 00:29:06 -0500 |
|---|---|---|
| committer | Jordan Wiens <github@psifertex.com> | 2025-12-19 00:29:06 -0500 |
| commit | 0facabad207dba55ff77f8af6de9e82a95f62080 (patch) | |
| tree | 86db4447f3941399bffafe6cebe3fd59a5b61117 /examples/triage | |
| parent | c09bba838812f061372349c08984fa7a9355503b (diff) | |
differentiate between 0x0 entry and no entry
Diffstat (limited to 'examples/triage')
| -rw-r--r-- | examples/triage/headers.cpp | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/examples/triage/headers.cpp b/examples/triage/headers.cpp index 6d6e2623..4191cf16 100644 --- a/examples/triage/headers.cpp +++ b/examples/triage/headers.cpp @@ -95,8 +95,11 @@ GenericHeaders::GenericHeaders(BinaryViewRef data) AddField("Type", QString::fromStdString(data->GetTypeName())); if (data->GetDefaultPlatform()) AddField("Platform", QString::fromStdString(data->GetDefaultPlatform()->GetName())); - if (data->IsValidOffset(data->GetEntryPoint())) + auto entryFunctions = data->GetAllEntryFunctions(); + if (!entryFunctions.empty() && data->GetEntryPoint() != 0) AddField("Entry Point", QString("0x") + QString::number(data->GetEntryPoint(), 16), CodeHeaderField); + else + AddField("Entry Point", "None"); if (data->IsValidOffset(data->GetStart())) AddField("Current Base", QString("0x") + QString::number(data->GetStart(), 16), AddressHeaderField); AddField("Endianness", data->GetDefaultEndianness() == BigEndian ? "Big" : "Little"); @@ -128,8 +131,11 @@ PEHeaders::PEHeaders(BinaryViewRef data) AddField("Type", QString::fromStdString(data->GetTypeName())); if (data->GetDefaultPlatform()) AddField("Platform", QString::fromStdString(data->GetDefaultPlatform()->GetName())); - if (data->IsValidOffset(data->GetEntryPoint())) + auto entryFunctions = data->GetAllEntryFunctions(); + if (!entryFunctions.empty() && data->GetEntryPoint() != 0) AddField("Entry Point", QString("0x") + QString::number(data->GetEntryPoint(), 16), CodeHeaderField); + else + AddField("Entry Point", "None"); return; } @@ -159,7 +165,11 @@ PEHeaders::PEHeaders(BinaryViewRef data) AddField("Image Base", QString("0x") + QString::number(base, 16), AddressHeaderField); uint64_t entryPoint = currentBase + GetValueOfStructMember(data, optHeaderName, optHeaderStart, "addressOfEntryPoint"); - AddField("Entry Point", QString("0x") + QString::number(entryPoint, 16), CodeHeaderField); + auto entryFunctions = data->GetAllEntryFunctions(); + if (!entryFunctions.empty() && entryPoint != 0) + AddField("Entry Point", QString("0x") + QString::number(entryPoint, 16), CodeHeaderField); + else + AddField("Entry Point", "None"); uint64_t sectionAlign = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "sectionAlignment"); AddField("Section Alignment", QString("0x") + QString::number(sectionAlign, 16)); |