x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 5 Activity

DBG: use PointerToRawData in debug directory if no RVA is present

This commit is contained in:
Matthijs Lavrijsen 2021-01-31 00:49:46 +01:00
parent 5b43c22a64
commit f49835b3bf
No known key found for this signature in database
GPG Key ID: D40D1DBE299B83EA
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/dbg/module.cpp
View File

@ -463,7 +463,11 @@ static void ReadDebugDirectory(MODINFO & Info, ULONG_PTR FileMapVA)
const auto supported = [&Info](PIMAGE_DEBUG_DIRECTORY entry)
{
// Check for valid RVA
const auto offset = ModRvaToOffset(0, Info.headers, entry->AddressOfRawData);
ULONG_PTR offset = 0;
if(entry->AddressOfRawData)
offset = (ULONG_PTR)ModRvaToOffset(0, Info.headers, entry->AddressOfRawData);
else if(entry->PointerToRawData)
offset = entry->PointerToRawData;
if(!offset)
return false;
@ -556,7 +560,12 @@ static void ReadDebugDirectory(MODINFO & Info, ULONG_PTR FileMapVA)
}
// At this point we know the entry is a valid CV one
auto cvData = (unsigned char*)(FileMapVA + ModRvaToOffset(0, Info.headers, entry->AddressOfRawData));
ULONG_PTR offset = 0;
if(entry->AddressOfRawData)
offset = (ULONG_PTR)ModRvaToOffset(0, Info.headers, entry->AddressOfRawData);
else if(entry->PointerToRawData)
offset = entry->PointerToRawData;
auto cvData = (unsigned char*)(FileMapVA + offset);
auto signature = *(DWORD*)cvData;
if(signature == '01BN')
{