From e5e01868d55406873dae7b45770aed03840faa7e Mon Sep 17 00:00:00 2001 From: midipix Date: Fri, 30 Oct 2015 21:31:39 -0400 Subject: import lookup table: properly interpret the ordinal/name flag. --- src/main/pe_get_image_meta.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/main/pe_get_image_meta.c b/src/main/pe_get_image_meta.c index 0ee8e8e..f52c2e8 100644 --- a/src/main/pe_get_image_meta.c +++ b/src/main/pe_get_image_meta.c @@ -169,12 +169,11 @@ int pe_get_image_meta (const struct pe_raw_image * image, struct pe_image_meta * break; } - struct pe_hint_name_entry * pentry = (struct pe_hint_name_entry *)(base + m->hidata->ptr_to_raw_data - + m->idata[i].items[j].u.hint_name_tbl_rva - m->hidata->virtual_addr); + if (!m->idata[i].items[j].flags) { + struct pe_hint_name_entry * pentry = + (struct pe_hint_name_entry *)(base + m->hidata->ptr_to_raw_data + + m->idata[i].items[j].u.hint_name_tbl_rva - m->hidata->virtual_addr); - if (m->idata[i].items[j].flags) - m->idata[i].items[j].hint = pe_read_short(pentry->hint); - else { m->idata[i].items[j].name = (char *)pentry->name; #ifdef PERK_DEVEL printf("%s\n",m->idata[i].items[j].name); -- cgit v1.2.3