[FEATURE] In realign mode: preserve the original module base

hasherezade · Sep 7, 2024 · e4841b6 · e4841b6
1 parent 2ba7bdc
commit e4841b6
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/libpeconv/src/pe_dumper.cpp b/libpeconv/src/pe_dumper.cpp
@@ -58,7 +58,10 @@ bool peconv::dump_pe(
             unmapped_module = pe_virtual_to_raw(buffer, mod_size, (ULONGLONG)start_addr, out_size, false);
         }
         else if (dump_mode == peconv::PE_DUMP_REALIGN) {
-            unmapped_module = peconv::pe_realign_raw_to_virtual(buffer, mod_size, (ULONGLONG)start_addr, out_size);
+            // relocate to the original base
+            const ULONGLONG hdr_base = peconv::get_image_base(buffer);
+            peconv::update_image_base(buffer, (ULONGLONG)start_addr);
+            unmapped_module = peconv::pe_realign_raw_to_virtual(buffer, mod_size, (ULONGLONG)hdr_base, out_size);
         }
         // unmap the PE file (convert from the Virtual Format into Raw Format)
         if (unmapped_module) {