From f49835b3bf8368d757520b953e326422c7d7cdac Mon Sep 17 00:00:00 2001 From: Matthijs Lavrijsen Date: Sun, 31 Jan 2021 00:49:46 +0100 Subject: [PATCH] DBG: use PointerToRawData in debug directory if no RVA is present --- src/dbg/module.cpp | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/dbg/module.cpp b/src/dbg/module.cpp index 6f8e5daf..6ebc6c12 100644 --- a/src/dbg/module.cpp +++ b/src/dbg/module.cpp @@ -463,7 +463,11 @@ static void ReadDebugDirectory(MODINFO & Info, ULONG_PTR FileMapVA) const auto supported = [&Info](PIMAGE_DEBUG_DIRECTORY entry) { // Check for valid RVA - const auto offset = ModRvaToOffset(0, Info.headers, entry->AddressOfRawData); + ULONG_PTR offset = 0; + if(entry->AddressOfRawData) + offset = (ULONG_PTR)ModRvaToOffset(0, Info.headers, entry->AddressOfRawData); + else if(entry->PointerToRawData) + offset = entry->PointerToRawData; if(!offset) return false; @@ -556,7 +560,12 @@ static void ReadDebugDirectory(MODINFO & Info, ULONG_PTR FileMapVA) } // At this point we know the entry is a valid CV one - auto cvData = (unsigned char*)(FileMapVA + ModRvaToOffset(0, Info.headers, entry->AddressOfRawData)); + ULONG_PTR offset = 0; + if(entry->AddressOfRawData) + offset = (ULONG_PTR)ModRvaToOffset(0, Info.headers, entry->AddressOfRawData); + else if(entry->PointerToRawData) + offset = entry->PointerToRawData; + auto cvData = (unsigned char*)(FileMapVA + offset); auto signature = *(DWORD*)cvData; if(signature == '01BN') {