从磁盘位置读取PE文件时,我需要将RVA(从pdb文件获取的相对虚拟地址)映射到PE file(EXE)偏移量。为此,我需要将RVA转换为文件偏移量,以便可以从该位置读出GUIDS(CLSID,IID)。
问候
乌斯曼
最佳答案
template <class T> LPVOID GetPtrFromRVA(
DWORD rva,
T* pNTHeader,
PBYTE imageBase ) // 'T' = PIMAGE_NT_HEADERS
{
PIMAGE_SECTION_HEADER pSectionHdr;
INT delta;
pSectionHdr = GetEnclosingSectionHeader( rva, pNTHeader);
if ( !pSectionHdr )
return 0;
delta = (INT)(pSectionHdr->VirtualAddress-pSectionHdr->PointerToRawData);
return (PVOID) ( imageBase + rva - delta );
}
template <class T> PIMAGE_SECTION_HEADER GetEnclosingSectionHeader(
DWORD rva,
T* pNTHeader) // 'T' == PIMAGE_NT_HEADERS
{
PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(pNTHeader);
unsigned i;
for ( i=0; i < pNTHeader->FileHeader.NumberOfSections; i++, section++ )
{
// This 3 line idiocy is because Watcom's linker actually sets the
// Misc.VirtualSize field to 0. (!!! - Retards....!!!)
DWORD size = section->Misc.VirtualSize;
if ( 0 == size )
size = section->SizeOfRawData;
// Is the RVA within this section?
if ( (rva >= section->VirtualAddress) &&
(rva < (section->VirtualAddress + size)))
return section;
}
return 0;
}
应该做到这一点...