diff --git a/libpeconv b/libpeconv index ae5b66d50..20e67a21f 160000 --- a/libpeconv +++ b/libpeconv @@ -1 +1 @@ -Subproject commit ae5b66d50dc43e4c054a79be213f33baca6cdd25 +Subproject commit 20e67a21fb8d0c3d6d221b9c27d87959e5cd0ea5 diff --git a/postprocessors/results_dumper.cpp b/postprocessors/results_dumper.cpp index aa325eaa2..96904772d 100644 --- a/postprocessors/results_dumper.cpp +++ b/postprocessors/results_dumper.cpp @@ -311,9 +311,6 @@ bool pesieve::ResultsDumper::dumpModule(IN HANDLE processHandle, ModuleDumpReport *modDumpReport = new ModuleDumpReport(module_buf.getModuleBase(), module_buf.getBufferSize()); dumpReport.appendReport(modDumpReport); - if (out_base) { - modDumpReport->rebasedTo = out_base; - } modDumpReport->dumpFileName = makeModuleDumpPath(module_buf.getModuleBase(), module_name, payload_ext); modDumpReport->is_corrupt_pe = is_corrupt_pe; modDumpReport->is_shellcode = !module_buf.isValidPe() && module_buf.isCode(); @@ -342,6 +339,9 @@ bool pesieve::ResultsDumper::dumpModule(IN HANDLE processHandle, modDumpReport->isDumped = module_buf.dumpToFile(modDumpReport->dumpFileName); curr_dump_mode = peconv::PE_DUMP_VIRTUAL; } + if (curr_dump_mode != peconv::PE_DUMP_VIRTUAL && out_base) { + modDumpReport->rebasedTo = out_base; + } modDumpReport->mode_info = get_dump_mode_name(curr_dump_mode); bool iat_not_rebuilt = (imprec_res == ImpReconstructor::IMP_RECOVERY_ERROR) || (imprec_res == ImpReconstructor::IMP_RECOVERY_NOT_APPLICABLE); if (iat_not_rebuilt || save_imp_report) {