diff --git a/Il2CppInspector.Common/FileFormatStreams/FileFormatStream.cs b/Il2CppInspector.Common/FileFormatStreams/FileFormatStream.cs index 0cb92e4..968bd72 100644 --- a/Il2CppInspector.Common/FileFormatStreams/FileFormatStream.cs +++ b/Il2CppInspector.Common/FileFormatStreams/FileFormatStream.cs @@ -176,7 +176,7 @@ namespace Il2CppInspector try { if (type.GetMethod("Load", BindingFlags.FlattenHierarchy | BindingFlags.Static | BindingFlags.Public, null, new[] { typeof(BinaryObjectStream), typeof(LoadOptions), typeof(EventHandler) }, null) - .Invoke(null, new object[] { binaryObjectStream, loadOptions, statusCallback }) is IFileFormatStream loaded) { + .Invoke(null, [binaryObjectStream, loadOptions, statusCallback]) is IFileFormatStream loaded) { loaded.IsModified |= preProcessResult.IsStreamModified; return loaded; diff --git a/Il2CppInspector.Common/FileFormatStreams/PEReader.cs b/Il2CppInspector.Common/FileFormatStreams/PEReader.cs index f014c53..13b77ff 100644 --- a/Il2CppInspector.Common/FileFormatStreams/PEReader.cs +++ b/Il2CppInspector.Common/FileFormatStreams/PEReader.cs @@ -114,26 +114,31 @@ namespace Il2CppInspector section.Name = wantedSectionTypes[section.Characteristics]; // Get base of code - GlobalOffset = pe.ImageBase + pe.BaseOfCode - sections.First(x => x.Name == ".text").PointerToRawData; + GlobalOffset = pe.ImageBase + pe.BaseOfCode - sections + .FirstOrDefault(x => x.Characteristics.HasFlag(PE.IMAGE_SCN_MEM_EXECUTE))?.PointerToRawData ?? 0; // Confirm that .rdata section begins at same place as IAT - var rData = sections.First(x => x.Name == ".rdata"); - mightBePacked |= rData.VirtualAddress != IATStart; + var rData = sections.FirstOrDefault(x => x.Name == ".rdata"); + mightBePacked |= rData == null || rData.VirtualAddress != IATStart; + if (rData != null) + { + // Calculate start of function pointer table + pFuncTable = rData.PointerToRawData + IATSize; - // Calculate start of function pointer table - pFuncTable = rData.PointerToRawData + IATSize; - - // Skip over __guard_check_icall_fptr and __guard_dispatch_icall_fptr if present, then the following zero offset - Position = pFuncTable; - if (pe is PEOptHeader32) { - while (ReadUInt32() != 0) + // Skip over __guard_check_icall_fptr and __guard_dispatch_icall_fptr if present, then the following zero offset + Position = pFuncTable; + if (pe is PEOptHeader32) + { + while (ReadUInt32() != 0) + pFuncTable += 4; pFuncTable += 4; - pFuncTable += 4; - } - else { - while (ReadUInt64() != 0) + } + else + { + while (ReadUInt64() != 0) + pFuncTable += 8; pFuncTable += 8; - pFuncTable += 8; + } } // In the fist go round, we signal that this is at least a valid PE file; we don't try to unpack yet