From e37cc8151dd5e9fbec45da90bc3f951dcc73a347 Mon Sep 17 00:00:00 2001 From: ko1N Date: Thu, 10 Oct 2019 01:27:36 +0200 Subject: [PATCH] Added a switch which either reads Codeview Debugdata from pointer or address depending if rva is enabled or not --- src/pe/debug.rs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/pe/debug.rs b/src/pe/debug.rs index 87df364a..ec9f8224 100644 --- a/src/pe/debug.rs +++ b/src/pe/debug.rs @@ -19,7 +19,7 @@ impl<'a> DebugData<'a> { pub fn parse_with_opts(bytes: &'a [u8], dd: data_directories::DataDirectory, sections: &[section_table::SectionTable], file_alignment: u32, opts: &options::ParseOptions) -> error::Result { let image_debug_directory = ImageDebugDirectory::parse_with_opts(bytes, dd, sections, file_alignment, opts)?; - let codeview_pdb70_debug_info = CodeviewPDB70DebugInfo::parse(bytes, &image_debug_directory)?; + let codeview_pdb70_debug_info = CodeviewPDB70DebugInfo::parse_with_opts(bytes, &image_debug_directory, opts)?; Ok(DebugData{ image_debug_directory, @@ -89,6 +89,10 @@ pub struct CodeviewPDB70DebugInfo<'a> { impl<'a> CodeviewPDB70DebugInfo<'a> { pub fn parse(bytes: &'a [u8], idd: &ImageDebugDirectory) -> error::Result> { + Self::parse_with_opts(bytes, idd, &options::ParseOptions::default()) + } + + pub fn parse_with_opts(bytes: &'a [u8], idd: &ImageDebugDirectory, opts: &options::ParseOptions) -> error::Result> { if idd.data_type != IMAGE_DEBUG_TYPE_CODEVIEW { // not a codeview debug directory // that's not an error, but it's not a CodeviewPDB70DebugInfo either @@ -96,7 +100,10 @@ impl<'a> CodeviewPDB70DebugInfo<'a> { } // ImageDebugDirectory.pointer_to_raw_data stores a raw offset -- not a virtual offset -- which we can use directly - let mut offset: usize = idd.pointer_to_raw_data as usize; + let mut offset: usize = match opts.resolve_rva { + true => idd.pointer_to_raw_data as usize, + false => idd.address_of_raw_data as usize, + }; // calculate how long the eventual filename will be, which doubles as a check of the record size let filename_length = idd.size_of_data as isize - 24;