[BUGFIX] Allow to relocate to the original base for all modes except …

…VIRTUAL
hasherezade · Nov 2, 2024 · 20e67a2 · 20e67a2
1 parent ae5b66d
commit 20e67a2
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/libpeconv/src/pe_dumper.cpp b/libpeconv/src/pe_dumper.cpp
@@ -54,13 +54,15 @@ bool peconv::dump_pe(
         if (is_dot_net(buffer, mod_size)) {
             fix_dot_net_ep(buffer, mod_size);
         }
+        const ULONGLONG hdr_base = peconv::get_image_base(buffer);
+        if (dump_mode != peconv::PE_DUMP_VIRTUAL) {
+            // relocate to the original base
+            peconv::update_image_base(buffer, (ULONGLONG)start_addr);
+        }
         if (dump_mode == peconv::PE_DUMP_UNMAP) {
-            unmapped_module = pe_virtual_to_raw(buffer, mod_size, (ULONGLONG)start_addr, out_size, false);
+            unmapped_module = pe_virtual_to_raw(buffer, mod_size, (ULONGLONG)hdr_base, out_size, false);
         }
         else if (dump_mode == peconv::PE_DUMP_REALIGN) {
-            // relocate to the original base
-            const ULONGLONG hdr_base = peconv::get_image_base(buffer);
-            peconv::update_image_base(buffer, (ULONGLONG)start_addr);
             unmapped_module = peconv::pe_realign_raw_to_virtual(buffer, mod_size, (ULONGLONG)hdr_base, out_size);
         }
         // unmap the PE file (convert from the Virtual Format into Raw Format)