it 加油站

Rva2Offset
      /// <summary>
      /// The PE format frequently uses the term RVA (Relative Virtual Address). An RVA is the address of an item
      /// <i>once loaded into memory</i>, with the base address of the image file subtracted from it (i.e., the offset from the
      /// base address where the file is loaded). The RVA of an item will almost always differ from its position within
      /// the file on disk. To compute the file position of an item with RVA <i>r</i>, search all the sections in the PE file to find
      /// the section with RVA s, length <i>l</i> and file position <i>p </i>in which the RVA lies, ie <i>s ≤ r < s+l</i>. The file position of
      /// the item is then given by <i>p+(r-s)</i>.
      /// <see cref="c042927_ISO_IEC_23271_2006(E).pdf"/>page 299 of 556.
      /// </summary>
      /// <param name="rva"></param>
      /// <returns></returns>
-     public uint Rva2Offset(uint rva) {
        if (rva == 0)
          return 0;
-       else {
-         for (int i = 0; i < this.pe.SectionHeaders.Length; i++) {
            SectionHeader sh = this.pe.SectionHeaders[i];
            if ((sh.VirtualAddress <= rva) && (sh.VirtualAddress + sh.SizeOfRawData > rva))
              return (sh.PointerToRawData + (rva - sh.VirtualAddress));
          }
        }
        throw new Exception("Invalid RVA address.");
      }

posted on 2008-02-27 12:56  antilope  阅读(377)  评论(0)    收藏  举报