From e9e89b0b43057cf40c1283d463f76971152d0303 Mon Sep 17 00:00:00 2001
From: Matt Nadareski <mnadareski@outlook.com>
Date: Thu, 11 Sep 2025 10:33:10 -0400
Subject: [PATCH] This has been consistently wrong

---
 .../Deserializers/PortableExecutable.cs                     | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/SabreTools.Serialization/Deserializers/PortableExecutable.cs b/SabreTools.Serialization/Deserializers/PortableExecutable.cs
index c68eccdb..b424c608 100644
--- a/SabreTools.Serialization/Deserializers/PortableExecutable.cs
+++ b/SabreTools.Serialization/Deserializers/PortableExecutable.cs
@@ -335,8 +335,10 @@ namespace SabreTools.Serialization.Deserializers
 
                 if (optionalHeader.CertificateTable != null)
                 {
-                    offset = initialOffset
-                        + optionalHeader.CertificateTable.VirtualAddress.ConvertVirtualAddress(pex.SectionTable);
+                    // The Certificate Table entry points to a table of attribute certificates. These
+                    // certificates are not loaded into memory as part of the image. As such, the first
+                    // field of this entry, which is normally an RVA, is a file pointer instead.
+                    offset = initialOffset + optionalHeader.CertificateTable.VirtualAddress;
                     if (offset > initialOffset && offset < data.Length)
                     {
                         // Get the required table size