public ulong VAToOffset(SectionTableEntry section, ulong va)
{
var imageBase = _image.NTHeaders.OptionalHeader.ImageBase;
var rva = Convert.ToUInt32(va - imageBase);
return(RVAToOffset(section, rva));
}
public SectionTableEntry RVAToSectionTableEntry(uint rva)
{
if (_image.SectionTable == null)
{
return(null);
}
var entries = _image.SectionTable.OrderBy(e => e.VirtualAddress).ToArray();
SectionTableEntry entry = null;
for (var i = 0; i < entries.Length; i++)
{
var maxRVA = entries[i].VirtualAddress + entries[i].SizeOfRawData;
if (i != (entries.Length - 1))
{
maxRVA = entries[i + 1].VirtualAddress;
}
if (rva >= entries[i].VirtualAddress && rva < maxRVA)
{
entry = entries[i];
}
}
return(entry);
}
public ulong OffsetToVA(SectionTableEntry section, ulong offset)
{
var imageBase = _image.NTHeaders.OptionalHeader.ImageBase;
var rva = Convert.ToUInt32((offset + section.VirtualAddress) - section.PointerToRawData);
return(imageBase + rva);
}
internal Section(PortableExecutableImage image, Sections sections, SectionTableEntry tableEntry)
{
_image = image;
var imageBase = _image.NTHeaders.OptionalHeader.ImageBase;
Sections = sections;
TableEntry = tableEntry;
Location = new Location(image, tableEntry.PointerToRawData, tableEntry.VirtualAddress, imageBase + tableEntry.VirtualAddress, tableEntry.SizeOfRawData, tableEntry.VirtualSizeOrPhysicalAddress);
}
private Section GetSection(SectionTableEntry tableEntry)
{
if (!_sections.ContainsKey(tableEntry))
{
var section = new Section(_image, this, tableEntry);
_sections[tableEntry] = section;
}
return(_sections[tableEntry]);
}
public ulong OffsetToVA(ulong offset)
{
var entries = _image.SectionTable.OrderBy(e => e.PointerToRawData).ToArray();
SectionTableEntry entry = null;
for (var i = 0; i < entries.Length; i++)
{
if (offset >= entries[i].PointerToRawData && offset < (entries[i].PointerToRawData + entries[i].SizeOfRawData))
{
entry = entries[i];
}
}
if (entry != null)
{
return(OffsetToVA(entry, offset));
}
return(0);
}
public ulong RVAToOffset(uint rva)
{
var entries = _image.SectionTable.OrderBy(e => e.VirtualAddress).ToArray();
SectionTableEntry entry = null;
for (var i = 0; i < entries.Length; i++)
{
if (rva >= entries[i].VirtualAddress && rva < (entries[i].VirtualAddress + entries[i].SizeOfRawData))
{
entry = entries[i];
}
}
if (entry != null)
{
return(RVAToOffset(entry, rva));
}
return(0);
}
public Section this[SectionTableEntry tableEntry] => GetSection(tableEntry);
public uint OffsetToRVA(SectionTableEntry section, ulong offset)
{
var rva = Convert.ToUInt32((offset + section.VirtualAddress) - section.PointerToRawData);
return(rva);
}
public ulong RVAToOffset(SectionTableEntry section, uint rva)
{
var offset = (rva - section.VirtualAddress) + section.PointerToRawData;
return(offset);
}