Advertisement
Guest User

RVA to File Offset x86 PE windows

a guest
Jul 25th, 2017
1,650
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 0.95 KB | None | 0 0
  1. DWORD RVAtoFileOffset(PIMAGE_NT_HEADER pNTHeader, DWORD RVA) {
  2.  
  3.     PIMAGE_FILE_HEADER fileHeader = &(ntHeader->FileHeader);
  4.     PIMAGE_OPTIONAL_HEADER optionalHeader = &(ntHeader->OptionalHeader);
  5.     WORD sizeOfOptionalHeader = fileHeader->SizeOfOptionalHeader;
  6.  
  7.     WORD numberOfSections = fileHeader->NumberOfSections;
  8.  
  9.     PIMAGE_SECTION_HEADER firstSectionHeader;
  10.     firstSectionHeader = (PIMAGE_SECTION_HEADER)(((PBYTE)optionalHeader) + sizeOfOptionalHeader);
  11.  
  12.     PIMAGE_SECTION_HEADER section = firstSectionHeader;
  13.     for (int i = 0; i < numberOfSections; i++) {
  14.  
  15.         DWORD VirtualAddress = section->VirtualAddress;
  16.         DWORD VirtualSize = section->Misc.VirtualSize;
  17.  
  18.         if (VirtualAddress <= RVA && RVA < VirtualAddress + VirtualSize) {
  19.             // RVA is in this section.
  20.             return (RVA - VirtualAddress) + section->PointerToRawData;
  21.         }
  22.  
  23.         // next section...
  24.         section = (PIMAGE_SECTION_HEADER)(((PBYTE)section) + sizeof(IMAGE_SECTION_HEADER) );
  25.     }
  26.  
  27.     return 0;
  28. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement