diff --git a/Il2CppInspector/FileFormatReaders/FormatLayouts/PE.cs b/Il2CppInspector/FileFormatReaders/FormatLayouts/PE.cs index ccfe469..3c01353 100644 --- a/Il2CppInspector/FileFormatReaders/FormatLayouts/PE.cs +++ b/Il2CppInspector/FileFormatReaders/FormatLayouts/PE.cs @@ -35,6 +35,7 @@ namespace Il2CppInspector PE ExpectedMagic { get; } ushort Magic { get; } ulong ImageBase { get; } + uint BaseOfCode { get; } RvaEntry[] DataDirectory { get; } } @@ -43,6 +44,7 @@ namespace Il2CppInspector public PE ExpectedMagic => PE.IMAGE_NT_OPTIONAL_HDR32_MAGIC; public ushort Magic => f_Magic; public ulong ImageBase => f_ImageBase; + public uint BaseOfCode => f_BaseOfCode; public RvaEntry[] DataDirectory => f_DataDirectory; public ushort f_Magic; @@ -52,7 +54,7 @@ namespace Il2CppInspector public uint SizeOfInitializedData; public uint SizeOfUninitializedData; public uint AddressOfEntryPoint; - public uint BaseOfCode; + public uint f_BaseOfCode; public uint BaseOfData; public uint f_ImageBase; public uint SectionAlignment; @@ -85,6 +87,7 @@ namespace Il2CppInspector public PE ExpectedMagic => PE.IMAGE_NT_OPTIONAL_HDR64_MAGIC; public ushort Magic => f_Magic; public ulong ImageBase => f_ImageBase; + public uint BaseOfCode => f_BaseOfCode; public RvaEntry[] DataDirectory => f_DataDirectory; public ushort f_Magic; @@ -94,7 +97,7 @@ namespace Il2CppInspector public uint SizeOfInitializedData; public uint SizeOfUninitializedData; public uint AddressOfEntryPoint; - public uint BaseOfCode; + public uint f_BaseOfCode; public ulong f_ImageBase; public uint SectionAlignment; public uint FileAlignment; diff --git a/Il2CppInspector/FileFormatReaders/PEReader.cs b/Il2CppInspector/FileFormatReaders/PEReader.cs index 076f5e6..bb0f837 100644 --- a/Il2CppInspector/FileFormatReaders/PEReader.cs +++ b/Il2CppInspector/FileFormatReaders/PEReader.cs @@ -10,6 +10,9 @@ using System.Linq; namespace Il2CppInspector { + // References: + // PE Header file: https://github.com/dotnet/llilc/blob/master/include/clr/ntimage.h + // PE format specification: https://docs.microsoft.com/en-us/windows/win32/debug/pe-format?redirectedfrom=MSDN internal class PEReader : FileFormatReader { private COFFHeader coff; @@ -96,7 +99,8 @@ namespace Il2CppInspector pFuncTable += 8; } - GlobalOffset = pe.ImageBase; + // Get base of code + GlobalOffset = pe.ImageBase + pe.BaseOfCode - sections.First(x => x.Name == ".text").PointerToRawData; return true; } @@ -113,9 +117,9 @@ namespace Il2CppInspector if (uiAddr == 0) return 0; - var section = sections.First(x => uiAddr - GlobalOffset >= x.VirtualAddress && - uiAddr - GlobalOffset < x.VirtualAddress + x.SizeOfRawData); - return (uint) (uiAddr - section.VirtualAddress - GlobalOffset + section.PointerToRawData); + var section = sections.First(x => uiAddr - pe.ImageBase >= x.VirtualAddress && + uiAddr - pe.ImageBase < x.VirtualAddress + x.SizeOfRawData); + return (uint) (uiAddr - section.VirtualAddress - pe.ImageBase + section.PointerToRawData); } } }