binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Triage view shows outdated addresses after a PE has been rebased

Open xusheng6 opened this issue 3 years ago • 0 comments

Before and after rebase: Screen Shot 2022-08-25 at 12 01 17 PM

Screen Shot 2022-08-25 at 12 01 43 PM

We can see only the Currrent Base field reflects the rebased view, other addresses are still showing the old value. This is because we are reading this info from the binary directly:

https://github.com/Vector35/binaryninja-api/blob/077462c083af241bf654d87a8aaa776834f0e3dc/examples/triage/headers.cpp#L159

xusheng6 avatar Aug 25 '22 04:08 xusheng6