diff options
| author | Xusheng <xusheng@vector35.com> | 2020-08-07 15:27:17 +0800 |
|---|---|---|
| committer | Xusheng <xusheng@vector35.com> | 2020-08-07 15:27:17 +0800 |
| commit | 895c2a325a8e5c874cf56e75c72ba77789b3f0f9 (patch) | |
| tree | 935f6b2f9a501fe83439f036eb0fd3d7d72cd71b /examples | |
| parent | 3086a0550aee083a1ed2c75d09faea9af4a1d480 (diff) | |
add current base for PE headers in Triage
Diffstat (limited to 'examples')
| -rw-r--r-- | examples/triage/headers.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/examples/triage/headers.cpp b/examples/triage/headers.cpp index 5a7d44d7..ee44bc75 100644 --- a/examples/triage/headers.cpp +++ b/examples/triage/headers.cpp @@ -127,6 +127,8 @@ PEHeaders::PEHeaders(BinaryViewRef data) QDateTime t = QDateTime::fromSecsSinceEpoch(secs); AddField("Timestamp", t.toString()); + AddField("Current Base", QString("0x") + QString::number(data->GetStart(), 16), AddressHeaderField); + uint64_t base = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "imageBase"); AddField("Image Base", QString("0x") + QString::number(base, 16), AddressHeaderField); |