Skip to content

Round down PointerToRawData to the nearest multiple 0x200#9176

Open
XOR-RAX wants to merge 1 commit into
NationalSecurityAgency:masterfrom
XOR-RAX:pointer-to-raw-data
Open

Round down PointerToRawData to the nearest multiple 0x200#9176
XOR-RAX wants to merge 1 commit into
NationalSecurityAgency:masterfrom
XOR-RAX:pointer-to-raw-data

Conversation

@XOR-RAX
Copy link
Copy Markdown

@XOR-RAX XOR-RAX commented May 10, 2026

This patch rounds down PointerToRawData to the nearest multiple 0x200. And it correctly loads sections where PointerToRawData is between 0x001 and 0x1ff. This fixes #9170

@ryanmkurtz ryanmkurtz self-assigned this May 11, 2026
@ryanmkurtz ryanmkurtz added Feature: Loader/PE Status: Triage Information is being gathered labels May 11, 2026
CryptoJones added a commit to CryptoJones/GayHydra that referenced this pull request May 21, 2026
…to nearest multiple of 0x200 (#129)

Cherry-picked from NationalSecurityAgency#9176 (closes upstream issue NationalSecurityAgency#9170).

Original commit: NSA/ghidra@1d3180b56f4354631d644e94e8f4d7eafad6ceac
Original author: XOR-RAX <XOR-RAX@outlook.com>

Co-authored-by: XOR-RAX <XOR-RAX@outlook.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature: Loader/PE Status: Triage Information is being gathered

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Disassembly/Decompile manipulation due to loading discrepancy in PE

2 participants