From 90b618fe8bcf8ce8f1f349c79446d8873747fac1 Mon Sep 17 00:00:00 2001 From: Xiaoyin Liu Date: Sun, 7 Aug 2022 06:35:58 +0400 Subject: [PATCH] Correct PE rich header write method IMAGE_DANS_SIGNATURE should be XOR'ed with the mask. --- .../src/main/java/ghidra/app/util/bin/format/pe/RichHeader.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/RichHeader.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/RichHeader.java index 6fe847e5fc..f56155cd4d 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/RichHeader.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/pe/RichHeader.java @@ -111,7 +111,7 @@ public class RichHeader implements StructConverter, Writeable { public void write(RandomAccessFile raf, DataConverter dc) throws IOException { if (table != null) { - raf.write(dc.getBytes(IMAGE_DANS_SIGNATURE)); + raf.write(dc.getBytes(IMAGE_DANS_SIGNATURE ^ table.getMask())); raf.write(dc.getBytes(table.getMask())); // 0 ^ mask raf.write(dc.getBytes(table.getMask())); // 0 ^ mask