From 189347b8cffb0e77ae53ddf953cb0390f2a233d3 Mon Sep 17 00:00:00 2001 From: naci Date: Fri, 15 Nov 2024 02:31:28 +0300 Subject: [PATCH] preparation for 32-bit support --- lifter/lifter.cpp | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/lifter/lifter.cpp b/lifter/lifter.cpp index 98f81e3..d16b851 100644 --- a/lifter/lifter.cpp +++ b/lifter/lifter.cpp @@ -149,7 +149,21 @@ void InitFunction_and_LiftInstructions(const ZyanU64 runtime_address, if (*(unsigned short*)fileBase != 0x5a4d) { UNREACHABLE("Only PE files are supported"); } - auto ntHeaders = (win::nt_headers_x64_t*)(fileBase + dosHeader->e_lfanew); + + auto IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b; + auto IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b; + + auto PEmagic = *(uint16_t*)(fileBase + dosHeader->e_lfanew); + auto x86_or_x64 = PEmagic != IMAGE_NT_OPTIONAL_HDR64_MAGIC; + + auto ntHeaders = (win::nt_headers_t*)(fileBase + dosHeader->e_lfanew); + + if (PEmagic != IMAGE_NT_OPTIONAL_HDR64_MAGIC) { + UNREACHABLE("Only 64-bit PE files are supported"); + } + + std::cout << "magic:" << ntHeaders->optional_header.magic << "\n"; + auto ADDRESS = ntHeaders->optional_header.image_base; auto imageSize = ntHeaders->optional_header.size_image; auto stackSize = ntHeaders->optional_header.size_stack_reserve;