Example #1
0
        // Heathcliff74
        public UInt32 ConvertVirtualToRaw(UInt32 VirtualOffset)
        {
            IMAGE_SECTION_HEADER?SectionHeaderSelection = _sectionHeaders.Where(h => (((GetOptionalHeaders32().ImageBase + h.VirtualAddress) <= VirtualOffset) && ((GetOptionalHeaders32().ImageBase + h.VirtualAddress + h.SizeOfRawData) > VirtualOffset))).FirstOrDefault();

            if (SectionHeaderSelection == null)
            {
                throw new ArgumentOutOfRangeException();
            }

            IMAGE_SECTION_HEADER SectionHeader = (IMAGE_SECTION_HEADER)SectionHeaderSelection;

            if (string.IsNullOrEmpty(SectionHeader.Name) || (SectionHeader.SizeOfRawData == 0))
            {
                throw new ArgumentOutOfRangeException();
            }

            return(SectionHeader.PointerToRawData + (VirtualOffset - SectionHeader.VirtualAddress - GetOptionalHeaders32().ImageBase));
        }
Example #2
0
        internal uint ConvertRawOffsetToVirtualAddress(uint RawOffset)
        {
            // TODO: Add 64-bit support
            if (RawOffset < (Sections.OrderBy(s => s.VirtualAddress).First().Header.PointerToRawData))
            {
                return(RawOffset + GetOptionalHeaders32().ImageBase);
            }

            IMAGE_SECTION_HEADER?SectionHeaderSelection = _sectionHeaders.Where(h => ((h.PointerToRawData <= RawOffset) && ((h.PointerToRawData + h.SizeOfRawData) > RawOffset))).FirstOrDefault();

            if (SectionHeaderSelection == null)
            {
                throw new ArgumentOutOfRangeException();
            }

            IMAGE_SECTION_HEADER SectionHeader = (IMAGE_SECTION_HEADER)SectionHeaderSelection;

            if (string.IsNullOrEmpty(SectionHeader.Name) || (SectionHeader.SizeOfRawData == 0))
            {
                throw new ArgumentOutOfRangeException();
            }

            return(RawOffset - SectionHeader.PointerToRawData + SectionHeader.VirtualAddress + GetOptionalHeaders32().ImageBase);
        }