search

erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files
MIT License
1.88k stars 522 forks source link

ImageBase for PE32+ Files not correct #296

Open berndb84 opened 4 years ago

berndb84 commented 4 years ago

Hello, I have build a DLL as a PE32+ executable (64Bit). With pefile in Python I read the ImageBase with pe.OPTIONAL_HEADER.ImageBase. The result in hex format is 0x180000000. But when I use a Portable Executable Viewer like NikPEViewer the ImageBase is 0x80000000.

I think 0x180000000 is not the correct address.

demberto commented 2 years ago

I think you should check it with multiple tools, try ExeInfoPe once

Edit: You should probably check in dnSpy