Get a pointer from an RVA
-
template LPVOID GetPtrFromRVA( DWORD rva, T* pNTHeader, PBYTE imageBase ) // 'T' = PIMAGE_NT_HEADERS
{
PIMAGE_SECTION_HEADER pSectionHdr;
INT delta;pSectionHdr = GetEnclosingSectionHeader( rva, pNTHeader ); if ( !pSectionHdr ) return 0; delta = (INT)(pSectionHdr->VirtualAddress-pSectionHdr->PointerToRawData); return (PVOID) ( imageBase + rva - delta );}
These lines of code were taken from Matt Pietrek's PEDump (http://www.wheaty.net/[^]). This function takes an RVA and gives you an actual memory address where this RVA is located. imageBase - is the image base where the PE file being viewed is mapped. pSectionHdr - is a pointer to a section where the rva falls in. Now I don't understand the last line of the function. Wouldn't
imageBase + rvabe enough? Why would we factor in thisdeltavariable? On top of that,pSectionHdr->VirtualAddressandpSectionHdr->PointerToRawDatapoint at the same information but in two different contexts. The VirtualAddress is the RVA of the section and PointerToRawData is the file offset of the section. Therefore, the load offset cannot always be the same as the file offset. // Afterall, I realized that even my comment lines have bugs If the sun were to blow up, it would take us 7-8 minutes to realize it. -
template LPVOID GetPtrFromRVA( DWORD rva, T* pNTHeader, PBYTE imageBase ) // 'T' = PIMAGE_NT_HEADERS
{
PIMAGE_SECTION_HEADER pSectionHdr;
INT delta;pSectionHdr = GetEnclosingSectionHeader( rva, pNTHeader ); if ( !pSectionHdr ) return 0; delta = (INT)(pSectionHdr->VirtualAddress-pSectionHdr->PointerToRawData); return (PVOID) ( imageBase + rva - delta );}
These lines of code were taken from Matt Pietrek's PEDump (http://www.wheaty.net/[^]). This function takes an RVA and gives you an actual memory address where this RVA is located. imageBase - is the image base where the PE file being viewed is mapped. pSectionHdr - is a pointer to a section where the rva falls in. Now I don't understand the last line of the function. Wouldn't
imageBase + rvabe enough? Why would we factor in thisdeltavariable? On top of that,pSectionHdr->VirtualAddressandpSectionHdr->PointerToRawDatapoint at the same information but in two different contexts. The VirtualAddress is the RVA of the section and PointerToRawData is the file offset of the section. Therefore, the load offset cannot always be the same as the file offset. // Afterall, I realized that even my comment lines have bugs If the sun were to blow up, it would take us 7-8 minutes to realize it.gah?! Bikram Singh