Disecting a PE File, Revisited
-
Hi, First of all genuine thanks to all that contributed to my previous queery. It was really helpful, and moved things along. I wrote a method: MkRvaPrt() that takes an rva, and maps it successfully to the file location, rather than to the memory location where the object would be after using LoadLibrary(); Sections in a PE File are used where a block of binary data is mapped to a file location other than the offset in the file. What the MkRvaPtr() function does is, it checks whether the virtual address is within the ranges of any of the Section Headers, (irrespective of name), and, if so calculates the adjustment, and returns a pointer into the file. If it does not point into a section, it returns the rva offset into the File. This all works smooth, but sets the stage to several questions.:- Sometimes, the rva found, already points at the required data, at other occasions, it has to be converted with MkRvaPtr. e.g.: I need to use MkRvaPtr to get the name of each Import Module, but the list of "PtrsToImportNames" needs no such translation. Does this table consist of relative offsets to itself? If so, How was I to know! Kind Regards,:)
Bram van Kampen