|
楼主 |
发表于 2018-4-30 13:11:50
|
显示全部楼层
- DWORD RvaToFoa(const LPVOID pFileBuffer,DWORD dwRva)
- {
- PIMAGE_DOS_HEADER pDosHeader=NULL;
- PIMAGE_NT_HEADERS pNtHeader=NULL;
- PIMAGE_FILE_HEADER pPeHeader=NULL;
- PIMAGE_OPTIONAL_HEADER32 pOptionHeader=NULL;
- PIMAGE_SECTION_HEADER pSectionHeader=NULL;
- pDosHeader=(PIMAGE_DOS_HEADER)pFileBuffer;
- pNtHeader=(PIMAGE_NT_HEADERS)((DWORD)pFileBuffer+pDosHeader->e_lfanew);
- pPeHeader=(PIMAGE_FILE_HEADER)((DWORD)pNtHeader+4);
- pOptionHeader=(PIMAGE_OPTIONAL_HEADER32)((DWORD)pPeHeader+IMAGE_SIZEOF_FILE_HEADER);
- pSectionHeader=(PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader+pPeHeader->SizeOfOptionalHeader);
- //DWORD dwSectionCount=pPeHeader->NumberOfSections;
- DWORD dwMemoruAil=pOptionHeader->SectionAlignment;
- DWORD dwDiffer=0;
- //循环节表
-
- for(int i=0;i<pPeHeader->NumberOfSections;i++)
- {
- DWORD dwBlockCount=pSectionHeader[i].SizeOfRawData/dwMemoruAil;
- dwBlockCount+=pSectionHeader[i].SizeOfRawData%dwMemoruAil?1:0;
- DWORD dwSectionBeginRva=pSectionHeader[i].VirtualAddress;
- DWORD dwSectionEndRva=pSectionHeader[i].VirtualAddress+dwBlockCount*dwMemoruAil;
- if(dwRva>=dwSectionBeginRva&&dwRva<dwSectionEndRva)
- {
- dwDiffer=dwRva-dwSectionBeginRva;
- return pSectionHeader[i].PointerToRawData+dwDiffer;
- }
- else if(dwRva<dwSectionBeginRva)
- {
- return dwRva;
- }
- }
- return 0;
- }
复制代码 |
|