Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- DWORD RVAtoFileOffset(PIMAGE_NT_HEADER pNTHeader, DWORD RVA) {
- PIMAGE_FILE_HEADER fileHeader = &(ntHeader->FileHeader);
- PIMAGE_OPTIONAL_HEADER optionalHeader = &(ntHeader->OptionalHeader);
- WORD sizeOfOptionalHeader = fileHeader->SizeOfOptionalHeader;
- WORD numberOfSections = fileHeader->NumberOfSections;
- PIMAGE_SECTION_HEADER firstSectionHeader;
- firstSectionHeader = (PIMAGE_SECTION_HEADER)(((PBYTE)optionalHeader) + sizeOfOptionalHeader);
- PIMAGE_SECTION_HEADER section = firstSectionHeader;
- for (int i = 0; i < numberOfSections; i++) {
- DWORD VirtualAddress = section->VirtualAddress;
- DWORD VirtualSize = section->Misc.VirtualSize;
- if (VirtualAddress <= RVA && RVA < VirtualAddress + VirtualSize) {
- // RVA is in this section.
- return (RVA - VirtualAddress) + section->PointerToRawData;
- }
- // next section...
- section = (PIMAGE_SECTION_HEADER)(((PBYTE)section) + sizeof(IMAGE_SECTION_HEADER) );
- }
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement