From b421487586ba42439b420cad29fc7d93d7eea630 Mon Sep 17 00:00:00 2001 From: Brandon Miller Date: Thu, 16 May 2024 09:08:21 -0400 Subject: Removed loader.architecture from py mapped view Also updated Python API docs references to loader.architecture --- view/pe/teview.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'view/pe/teview.cpp') diff --git a/view/pe/teview.cpp b/view/pe/teview.cpp index 8355327a..1e89ed23 100644 --- a/view/pe/teview.cpp +++ b/view/pe/teview.cpp @@ -214,6 +214,9 @@ bool TEView::Init() ReadTEImageHeader(reader, header); ReadTEImageSectionHeaders(reader, header.numberOfSections); m_headersOffset = header.strippedSize - EFI_TE_IMAGE_HEADER_SIZE; + + // m_imageBase represents the base of the original PE image (before headers were stripped), not the base of the + // TE image (bv.start) m_imageBase = header.imageBase; // Set architecture and platform @@ -223,8 +226,7 @@ bool TEView::Init() if (settings->Contains("loader.imageBase")) { uint64_t baseOverride = settings->Get("loader.imageBase", this); - // TE image bases represent the base of the original PE (before headers are stripped) - make this - // adjustment for the user + // Apply the headers offset adjustment to compute the base of the original PE image m_imageBase = baseOverride - m_headersOffset; } -- cgit v1.3.1