From 9cf3397ef65f879c33b31add83148abe5ee914a8 Mon Sep 17 00:00:00 2001
From: j4nn <531585+j4nn@users.noreply.github.com>
Date: Sat, 17 Jan 2026 12:23:20 +0100
Subject: [PATCH] fix bug that failed to do PE relocs when built as 32bit
 binary

previously void pointer has been used as user arg with callback
to fix relocations - that worked when built in 64bit mode but produced
incorrect values when built in 32bit mode, making the exploit always
crash the target phone instead of succeeding

so this change now references proper 64bit value with the arg instead
---
 pe-load.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pe-load.cpp b/pe-load.cpp
index 4a36889..f6256da 100644
--- a/pe-load.cpp
+++ b/pe-load.cpp
@@ -49,7 +49,7 @@ static uint8_t *image_buff;
 static int fix_relocs(void *N, const VA &relocAddr, const reloc_type &type)
 {
   uint64_t *ptr;
-  uint64_t newbase = reinterpret_cast<uint64_t>(N);
+  uint64_t newbase = *static_cast<uint64_t *>(N);
 
   if (type == RELOC_ABSOLUTE)
     return 0;
@@ -141,7 +141,7 @@ int load_pe(const char *fname, void *buff, int maxsize, uint64_t base_va,
     for (i = 0; va < va_end; va++, i++)
         ReadByteAtVA(p, va, image_buff[i]);
 
-    IterRelocs(p, fix_relocs, (void *)base_va);
+    IterRelocs(p, fix_relocs, &base_va);
 
     if (code_boundary != NULL) {
         *code_boundary = 0;