From beb859128c4b8b227022fbff147e4b1efead279e Mon Sep 17 00:00:00 2001 From: Katy Coe Date: Tue, 4 Aug 2020 05:44:08 +0200 Subject: [PATCH] Ghidra: Only reset image base to zero for ELF binaries --- .../Outputs/ScriptResources/ghidra-api.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Il2CppInspector.Common/Outputs/ScriptResources/ghidra-api.py b/Il2CppInspector.Common/Outputs/ScriptResources/ghidra-api.py index 7a98459..09d78f8 100644 --- a/Il2CppInspector.Common/Outputs/ScriptResources/ghidra-api.py +++ b/Il2CppInspector.Common/Outputs/ScriptResources/ghidra-api.py @@ -47,8 +47,10 @@ def SetHeaderComment(addr, text): setPlateComment(toAddr(addr), text) def CustomInitializer(): - # Do we need this for PE/MachO? - currentProgram.setImageBase(toAddr(0), True) + # Ghidra sets the image base for ELF to 0x100000 for some reason + # https://github.com/NationalSecurityAgency/ghidra/issues/1020 + if currentProgram.getExecutableFormat().endswith('(ELF)'): + currentProgram.setImageBase(toAddr(0), True) def GetScriptDirectory(): # Ghidra doesn't define __file__ so we have to iterate all the scripts