diff options
| author | Matt Graeber <mattgraeber@gmail.com> | 2013-03-10 14:14:11 -0400 |
|---|---|---|
| committer | Matt Graeber <mattgraeber@gmail.com> | 2013-03-10 14:14:11 -0400 |
| commit | 4f7e59c5a7223e077936760343f65aee3cf9134c (patch) | |
| tree | 98dfbb749335e317d1d22c78e57b9d39544c7259 | |
| parent | 60c49734df3dbaf88a571e966495ee10ae3f4d3e (diff) | |
| download | PowerSploit-4f7e59c5a7223e077936760343f65aee3cf9134c.tar.gz PowerSploit-4f7e59c5a7223e077936760343f65aee3cf9134c.zip | |
Fixed export parsing bug in Get-PEHeader
| -rw-r--r-- | PETools/Get-PEHeader.ps1 | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/PETools/Get-PEHeader.ps1 b/PETools/Get-PEHeader.ps1 index 46ef75a..00afad8 100644 --- a/PETools/Get-PEHeader.ps1 +++ b/PETools/Get-PEHeader.ps1 @@ -751,7 +751,7 @@ $code = @" $Result['Ordinal'] = "0x$(($Key + $Base).ToString('X4'))" # Uncomment this after I somehow manage to implement the RVA for the imports # $Result['RVA'] = "0x$($FunctionHashTable[$Key].ToString('X8'))" - $Result['VA'] = "0x$(($FunctionHashTable[$Key] + $PEBaseAddr).ToString("X$([IntPtr]::Size*2)"))" + $Result['VA'] = "0x$(($FunctionHashTable[$Key] + $PEBaseAddr.ToInt64()).ToString("X$([IntPtr]::Size*2)"))" $Export = New-Object PSObject -Property $Result $Export.PSObject.TypeNames.Insert(0, 'Export') |