示例#1
0
        public ulong VAToOffset(SectionTableEntry section, ulong va)
        {
            var imageBase = _image.NTHeaders.OptionalHeader.ImageBase;
            var rva       = Convert.ToUInt32(va - imageBase);

            return(RVAToOffset(section, rva));
        }
示例#2
0
        public SectionTableEntry RVAToSectionTableEntry(uint rva)
        {
            if (_image.SectionTable == null)
            {
                return(null);
            }

            var entries             = _image.SectionTable.OrderBy(e => e.VirtualAddress).ToArray();
            SectionTableEntry entry = null;

            for (var i = 0; i < entries.Length; i++)
            {
                var maxRVA = entries[i].VirtualAddress + entries[i].SizeOfRawData;

                if (i != (entries.Length - 1))
                {
                    maxRVA = entries[i + 1].VirtualAddress;
                }

                if (rva >= entries[i].VirtualAddress && rva < maxRVA)
                {
                    entry = entries[i];
                }
            }

            return(entry);
        }
示例#3
0
        public ulong OffsetToVA(SectionTableEntry section, ulong offset)
        {
            var imageBase = _image.NTHeaders.OptionalHeader.ImageBase;
            var rva       = Convert.ToUInt32((offset + section.VirtualAddress) - section.PointerToRawData);

            return(imageBase + rva);
        }
示例#4
0
        internal Section(PortableExecutableImage image, Sections sections, SectionTableEntry tableEntry)
        {
            _image = image;

            var imageBase = _image.NTHeaders.OptionalHeader.ImageBase;

            Sections   = sections;
            TableEntry = tableEntry;
            Location   = new Location(image, tableEntry.PointerToRawData, tableEntry.VirtualAddress, imageBase + tableEntry.VirtualAddress, tableEntry.SizeOfRawData, tableEntry.VirtualSizeOrPhysicalAddress);
        }
示例#5
0
        private Section GetSection(SectionTableEntry tableEntry)
        {
            if (!_sections.ContainsKey(tableEntry))
            {
                var section = new Section(_image, this, tableEntry);

                _sections[tableEntry] = section;
            }

            return(_sections[tableEntry]);
        }
示例#6
0
        public ulong OffsetToVA(ulong offset)
        {
            var entries             = _image.SectionTable.OrderBy(e => e.PointerToRawData).ToArray();
            SectionTableEntry entry = null;

            for (var i = 0; i < entries.Length; i++)
            {
                if (offset >= entries[i].PointerToRawData && offset < (entries[i].PointerToRawData + entries[i].SizeOfRawData))
                {
                    entry = entries[i];
                }
            }

            if (entry != null)
            {
                return(OffsetToVA(entry, offset));
            }

            return(0);
        }
示例#7
0
        public ulong RVAToOffset(uint rva)
        {
            var entries             = _image.SectionTable.OrderBy(e => e.VirtualAddress).ToArray();
            SectionTableEntry entry = null;

            for (var i = 0; i < entries.Length; i++)
            {
                if (rva >= entries[i].VirtualAddress && rva < (entries[i].VirtualAddress + entries[i].SizeOfRawData))
                {
                    entry = entries[i];
                }
            }

            if (entry != null)
            {
                return(RVAToOffset(entry, rva));
            }

            return(0);
        }
示例#8
0
 public Section this[SectionTableEntry tableEntry] => GetSection(tableEntry);
示例#9
0
        public uint OffsetToRVA(SectionTableEntry section, ulong offset)
        {
            var rva = Convert.ToUInt32((offset + section.VirtualAddress) - section.PointerToRawData);

            return(rva);
        }
示例#10
0
        public ulong RVAToOffset(SectionTableEntry section, uint rva)
        {
            var offset = (rva - section.VirtualAddress) + section.PointerToRawData;

            return(offset);
        }