From bcfb2df84b1c08471317809f2fe4436bf910230d Mon Sep 17 00:00:00 2001 From: Xusheng Date: Mon, 27 Sep 2021 12:35:31 +0800 Subject: Show endianness information in the triage view --- examples/triage/headers.cpp | 3 +++ 1 file changed, 3 insertions(+) (limited to 'examples/triage/headers.cpp') diff --git a/examples/triage/headers.cpp b/examples/triage/headers.cpp index ee44bc75..325dbe8c 100644 --- a/examples/triage/headers.cpp +++ b/examples/triage/headers.cpp @@ -78,6 +78,7 @@ GenericHeaders::GenericHeaders(BinaryViewRef data) AddField("Entry Point", QString("0x") + QString::number(data->GetEntryPoint(), 16), CodeHeaderField); if (data->IsValidOffset(data->GetStart())) AddField("Current Base", QString("0x") + QString::number(data->GetStart(), 16), AddressHeaderField); + AddField("Endianness", data->GetDefaultEndianness() == BigEndian ? "Big" : "Little"); } @@ -117,6 +118,8 @@ PEHeaders::PEHeaders(BinaryViewRef data) machineName = machineName.mid((int)strlen("IMAGE_FILE_MACHINE_")); AddField("Machine", machineName); + AddField("Endianness", data->GetDefaultEndianness() == BigEndian ? "Big" : "Little"); + uint64_t subsysValue = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "subsystem"); QString subsysName = GetNameOfEnumerationMember(data, "pe_subsystem", subsysValue); if (subsysName.startsWith("IMAGE_SUBSYSTEM_")) -- cgit v1.3.1