From 895c2a325a8e5c874cf56e75c72ba77789b3f0f9 Mon Sep 17 00:00:00 2001 From: Xusheng Date: Fri, 7 Aug 2020 15:27:17 +0800 Subject: add current base for PE headers in Triage --- examples/triage/headers.cpp | 2 ++ 1 file changed, 2 insertions(+) (limited to 'examples/triage/headers.cpp') diff --git a/examples/triage/headers.cpp b/examples/triage/headers.cpp index 5a7d44d7..ee44bc75 100644 --- a/examples/triage/headers.cpp +++ b/examples/triage/headers.cpp @@ -127,6 +127,8 @@ PEHeaders::PEHeaders(BinaryViewRef data) QDateTime t = QDateTime::fromSecsSinceEpoch(secs); AddField("Timestamp", t.toString()); + AddField("Current Base", QString("0x") + QString::number(data->GetStart(), 16), AddressHeaderField); + uint64_t base = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "imageBase"); AddField("Image Base", QString("0x") + QString::number(base, 16), AddressHeaderField); -- cgit v1.3.1