Proposals / #735

PE32 debug-directory extractor takes an optional-header pointer

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-02

Ghidra v1804 · 39698f0

EAX is a pointer to the existing IMAGE_OPTIONAL_HEADER32 layout, not int32_t. The complete leaf reads NumberOfRvaAndSizes at +0x5c and, when count exceeds six, copies the two fields of DataDirectory[6] at +0x90/+0x94 to its outputs. All three offsets and DWORD widths match the existing /PE types exactly. Independent context is the complete PE parser: its 0x10b branch performs the same three reads, and its producer validates MZ/PE signatures and forms optionalHeader=ntHeader+0x18. Retype only this leaf's EAX slot to IMAGE_OPTIONAL_HEADER32*, preserving names, ECX/EDX/stack storage, convention and void return. The leaf has no incoming refs; this is API-only structural proof, not a runtime caller claim. The PE64 type is absent and is not invented.

Changes 1, applied together

1. Retype variable win 0x00404f60 EAX

   typeint32_t→IMAGE_OPTIONAL_HEADER32 *