1 files changed, 10 insertions, 8 deletions
diff --git a/sploit/payload/payload_entry.py b/sploit/payload/payload_entry.py
index 295a91f..2f8dbdd 100644
--- a/sploit/payload/payload_entry.py
+++ b/sploit/payload/payload_entry.py
@@ -41,21 +41,23 @@ class PayloadEntry(IndexEntry):
 # Concrete payload entry definitions
 
 class pointer(PayloadEntry):
-    """Generate an integer which is always a fixed offset from self.base."""
+    """Generate an integer which tracks the address of another payload field."""
 
-    def __init__(self, target=None):
+    def __init__(self, target=None, math=None):
         self.target = target
-
-    def payload_insert(self, payload):
-        if self.target is None:
-            self.target = self.base
-        self.target -= self.base
+        self.math = math
 
     def payload_len(self, payload):
         return arch.wordsize
 
     def payload_bytes(self, payload):
-        return itob(self.target + self.base)
+        if self.target is None:
+            addr = self.base
+        else:
+            addr = payload[self.target]
+        if callable(self.math):
+            addr = self.math(addr)
+        return itob(addr)
 
 class padlen(PayloadEntry):
     """Generate padding to reach a target payload length."""