From 417b784e27964cea6f5e8420d04e06cd437b9f06 Mon Sep 17 00:00:00 2001 From: Xiaoyin Liu Date: Sun, 7 Aug 2022 07:12:34 +0400 Subject: [PATCH] Correct wrong GCC/VS compiler detection The GCC's offset to code may not necessarily be 0x1000. --- .../src/main/java/ghidra/app/util/opinion/PeLoader.java | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/PeLoader.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/PeLoader.java index bd92a7c0d4..02b1b747e4 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/PeLoader.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/PeLoader.java @@ -1054,14 +1054,7 @@ public class PeLoader extends AbstractPeDebugLoader { // return compilerType; // } - // Now look for offset to code (0x1000 for gcc) and PointerToSymbols - // (0 for VS, non-zero for gcc) - int addrCode = br.readInt(dh.e_lfanew() + 40); - if (addrCode != 0x1000) { - compilerType = CompilerEnum.VisualStudio; - return compilerType; - } - + // Now look for PointerToSymbols (0 for VS, non-zero for gcc) int ptrSymTable = br.readInt(dh.e_lfanew() + 12); if (ptrSymTable != 0) { compilerType = CompilerEnum.GCC;