From d4d9e3fe150955598cbaa40608fcbff3487a2533 Mon Sep 17 00:00:00 2001
From: Xusheng <xusheng@vector35.com>
Date: Mon, 10 Jun 2024 17:07:09 +0800
Subject: Correctly parse the value of guardCFCheckFunctionPointer and
 guardCFDispatchFunctionPointer in case of rebasing. Fix
 https://github.com/Vector35/binaryninja-api/issues/5535

---
 view/pe/peview.cpp | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'view/pe/peview.cpp')

diff --git a/view/pe/peview.cpp b/view/pe/peview.cpp
index bdf8175d..8e172e92 100644
--- a/view/pe/peview.cpp
+++ b/view/pe/peview.cpp
@@ -2303,6 +2303,7 @@ bool PEView::Init()
 				{
 					reader.Seek(RVAToFileOffset(guardCFCheckFunctionPointer - m_imageBase));
 					guardCFCheckFunction = m_is64 ? reader.Read64() : reader.Read32();
+					guardCFCheckFunction += (m_imageBase - m_peImageBase);
 				}
 
 				uint64_t guardCFDispatchFunction = 0;
@@ -2310,6 +2311,7 @@ bool PEView::Init()
 				{
 					reader.Seek(RVAToFileOffset(guardCFDispatchFunctionPointer - m_imageBase));
 					guardCFDispatchFunction = m_is64 ? reader.Read64() : reader.Read32();
+					guardCFDispatchFunction += (m_imageBase - m_peImageBase);
 				}
 
 				auto functionPointer = Type::PointerType(platform->GetArchitecture(), Type::FunctionType(Type::VoidType(), platform->GetDefaultCallingConvention(), {}));
-- 
cgit v1.3.1