GetSectionByRva() public static method

Gets the section of a list of sections by it's virtual offset
public static GetSectionByRva ( IEnumerable
sections, uint virtualoffset ) : Section
sections IEnumerable
The section list to search in.
virtualoffset uint The virtual offset to search for.
return Section
Esempio n. 1
0
        private static OffsetConverter CreateConverter(Win32Assembly assembly, ulong offset, int type)
        {
            OffsetConverter converter;

            switch (type)
            {
            case 2:
                converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)offset));
                break;

            case 3:
                converter = new OffsetConverter(Section.GetSectionByRva(assembly, (uint)(offset - assembly.ntHeader.OptionalHeader.ImageBase)));
                break;

            default:     // case 1:
                converter = new OffsetConverter(Section.GetSectionByFileOffset(assembly, (uint)offset));
                break;
            }
            if (converter.TargetSection == null)
            {
                converter = new OffsetConverter(assembly);
            }

            return(converter);
        }
Esempio n. 2
0
        /// <summary>
        /// Converts the offset to an Ascii String pointer.
        /// </summary>
        /// <param name="assembly">The assembly that contains the offset</param>
        /// <returns></returns>
        public ulong ToAsciiStringPtr(Win32Assembly assembly)
        {
            Section targetsection = Section.GetSectionByRva(assembly, Rva);
            ulong   stroffset     = Va - assembly.ntHeader.OptionalHeader.ImageBase - targetsection.RVA + targetsection.RawOffset;

            // if (stroffset < 0)
            //     throw new ArgumentException("The target offset is not a valid offset to a string");
            return(stroffset);
        }
        internal ResourceDataEntry(PeImage image, uint offset, ResourceDirectoryEntry parentEntry, Structures.IMAGE_RESOURCE_DATA_ENTRY rawDataEntry)
        {
            this.image        = image;
            this.offset       = offset;
            this.ParentEntry  = parentEntry;
            this.rawDataEntry = rawDataEntry;

            Section resourceSection = Section.GetSectionByRva(image.ParentAssembly, image.ParentAssembly.ntHeader.OptionalHeader.DataDirectories[(int)DataDirectoryName.Resource].TargetOffset.Rva);

            targetOffset = OffsetToData - resourceSection.RVA + resourceSection.RawOffset;
        }
Esempio n. 4
0
        internal DataDirectory(DataDirectoryName name, Section[] assemblySections, uint offset, Structures.IMAGE_DATA_DIRECTORY rawDataDir)
        {
            this.rawDataDir = rawDataDir;
            this.name       = name;
            if (rawDataDir.RVA == 0)
            {
                targetOffset = new Offset(0, 0, 0);
            }
            else
            {
                this.headerOffset = offset;

                targetSection = Section.GetSectionByRva(assemblySections, rawDataDir.RVA);
                if (targetSection == null)
                {
                    this.TargetOffset = new Offset(0, rawDataDir.RVA, 0);
                }
                else
                {
                    this.targetOffset = Offset.FromRva(rawDataDir.RVA, assemblySections[0].ParentAssembly);
                }
            }
        }