Read the addresses in the exe headers as little endian

This commit is contained in:
Anonymous Maarten 2023-06-30 01:24:50 +02:00
parent 3d7b08e3e6
commit 4b69132082

View File

@ -76,15 +76,15 @@ def __init__(self, filename):
# Read ImageBase
self.file.seek(0xB4)
self.imagebase = struct.unpack('i', self.file.read(4))[0]
self.imagebase, = struct.unpack('<i', self.file.read(4))
# Read .text VirtualAddress
self.file.seek(0x184)
self.textvirt = struct.unpack('i', self.file.read(4))[0]
self.textvirt, = struct.unpack('<i', self.file.read(4))
# Read .text PointerToRawData
self.file.seek(0x18C)
self.textraw = struct.unpack('i', self.file.read(4))[0]
self.textraw, = struct.unpack('<i', self.file.read(4))
logger.debug('... Parsing finished')
def __del__(self):