(Y)SALUDOS!:alright:
Posted on 2004-06-16 15:13:03 by AarzaK
Now why would a first time poster be interested in converting RVAs? I hope your not looking to make patcher of some sort....?

:NaN:
Posted on 2004-06-16 16:05:55 by NaN
Sorry for my english.

Is Only for curiosity, nothing but. Thanks!

(Y)SALUDOS! :alright:
Posted on 2004-06-16 16:13:24 by AarzaK
I am making a patcher. Now what?
Posted on 2004-06-16 17:56:29 by comrade
Ok friend but... how convert RVA to offset????? please dont Fight.....with anothers members... :) :) :) :) be happy!

Excume my English, I study very hard this.

(Y)SALUDOS!:alright:
Posted on 2004-06-16 18:05:56 by AarzaK
To find the rva from an offset o:

1. Find the section corresponding to this offset, then
2. RVA = offset + (section's virtual offset - section's raw offset)

Here is some code i wrote ages ago so it's probably rubbish but gives the idea.

``````

option prologue:none
option epilogue:none

; DWORD __stdcall ofstorva(LPVOID lpImage, DWORD dwOffset)
ofstorva proc
;	offstorva(o) === o + (sec.virtoffs - sec.rawoffs)
push ebx
push esi
mov ebx,[esp+8+4]
mov esi,[esp+8+8]
mov edx,ebx
cmp word ptr [edx],IMAGE_DOS_SIGNATURE
jnz otv_err
mov eax,[edx].Signature
cmp eax,IMAGE_NT_SIGNATURE
jnz otv_err
xor ecx,ecx
test ecx,ecx
jz otv_err										; no sections
xor eax,eax
assume edx:nothing
lea edx,[edx+18h+eax]							; edx -> section table
; search object table for section containing this rva
next:
mov eax,[edx].PointerToRawData
cmp esi,eax
jb skipsec							; if esi < sec_ra, skip sec
cmp esi,eax							; if esi < (sec_ra + rsize), found
jb found
skipsec:
lea edx,[edx+28h]					; go to next section
dec ecx
jnz next
pop eax				; clean image base off stack
jmp otv_err
found:
; calculate file offset from rva
sub eax,[edx].PointerToRawData
add esi,eax							; esi -> rva
assume edx:nothing
pop eax
; rva to va (commented here to get rva)
;	lea eax,[esi+eax]
jmp otv_ok
otv_err:
xor eax,eax
otv_ok:
pop esi
pop ebx
retn 8

ofstorva endp

option prologue:prologuedef
option epilogue:epiloguedef
``````
Posted on 2004-06-16 20:28:46 by stormix
"I am making a patcher. Now what?"
Seichas v milicii, potom v Sibiri
Posted on 2004-06-16 21:59:58 by lingo12
You might want to read through Iczelion's PE tutorials... and get the Microsoft PE docs, and read the Pietrek articles.
Posted on 2004-06-17 05:17:53 by f0dder
Thanks friends!!!!!!
Posted on 2004-06-18 08:31:47 by AarzaK