How to convert RVA to Offset and Offset to RVA? Can you write me these procedures: RVAtoOffset & OffsettoRVA?
Help me!
Posted on 2002-01-17 22:09:26 by vkdt
Check http://protools.cjb.net There are a few utilities that do exactly what you specified and they come with source :)
Posted on 2002-01-17 23:45:28 by Eagle17
Hmm protools seems to be down :( maybe that link will work a little later.. I don't have any code on me but since I am assuming you are making this for PE files heres how you would do it: load the pe file, go to the section headers.. find out which section your RVA is located in, then subtract that sections Virtual Address (VA) and add that sections PointerToRawData. I believe there is some good PE header documentation on Iczelions site if you need any further help.. good luck
Posted on 2002-01-18 00:06:30 by Eagle17
Protools is down at the moment, because the guy running the server
got a notice from the UK Secret Service (I'm not kidding here). It
p1sses me off when *legal* sites are shut down like this. Bleh!

As for your problem, vkdt, it should all become very clear by reading
the LUEVELSMEYER PE documentation and by reading Iczelion's
tutorials. It's not like it's hard or anything ;).

Eagle's explanation is a little flawed, but the big picture is okay:
you loop through the section headers and do some checks. Hm, I
even think I saw another post here that showed how to do it.

Also, posts beginning with "Howto: " are meant to contain a solution
on how to do something - not a question. But I guess this thread
will eventually hold the solution and can then be moved to the
algos & source section :).

Oh well, have to go help a friend with his new Pentium4, otherwise
I'd written up a short explanation.
Posted on 2002-01-18 05:47:57 by f0dder
RVA - relative virtual adress
VA - virtual adress
RP - raw pointer

RVA is like a memory index if you add a memory-base
(imagebase) you'll get a VA and can use it to refer
to some data... a RVA alone is idle!

...so...

VA is the real offset to a position after the pe-file is mapped
to memory

RP is the raw file offset... in the pe-header you can use
a raw-pointer to refer to the original file-data like the
sections or whatever...

IMAGEBASE is the address where the PE file is about to be
mapped in memory... you'll need this value to calculate
VA'S

so you may ask "why not only VA's ???"... imagine two DLL's
with the same imagebase (0040000h)... now some app wants
to import functions from both lib's... the dll's would overwrite
themselves so they're forced to load at other free positions...
if i'm not wrong here this is called relocation... so one single
single VA could cause impact... RVA's are a flexible way to
calculate working adresses even if the host is relocated to
another imagebase...

oh and if i was you i wouln't touch icz's pe-tut... just type
"pe tutorial" in google and see what you get... ;)
Posted on 2002-01-18 06:31:42 by mob
thank mob!:)

i wrote these functions;)


RVA - relative virtual adress
VA - virtual adress
RP - raw pointer

RVA is like a memory index if you add a memory-base
(imagebase) you'll get a VA and can use it to refer
to some data... a RVA alone is idle!

...so...

VA is the real offset to a position after the pe-file is mapped
to memory

RP is the raw file offset... in the pe-header you can use
a raw-pointer to refer to the original file-data like the
sections or whatever...

IMAGEBASE is the address where the PE file is about to be
mapped in memory... you'll need this value to calculate
VA'S

so you may ask "why not only VA's ???"... imagine two DLL's
with the same imagebase (0040000h)... now some app wants
to import functions from both lib's... the dll's would overwrite
themselves so they're forced to load at other free positions...
if i'm not wrong here this is called relocation... so one single
single VA could cause impact... RVA's are a flexible way to
calculate working adresses even if the host is relocated to
another imagebase...

oh and if i was you i wouln't touch icz's pe-tut... just type
"pe tutorial" in google and see what you get... ;)
Posted on 2002-01-18 06:59:12 by vkdt
You can find implementations of these two functions in my CPUInfo project, in the Dependencies routines:
http://cpuinfo.svn.sourceforge.net/viewvc/cpuinfo/tags/CPUInfo-0.4a/Windows/Dependencies/Dependencies.cpp?revision=43&view=markup

/*----------------------------------------------------------*
*
* RVAToOffset: Convert value from RVA to file offset.
*----------------------------------------------------------*/
DWORD RVAToOffset(IMAGE_NT_HEADERS32* pNtHdr, DWORD dwRVA)
{
int i;
WORD wSections;
PIMAGE_SECTION_HEADER pSectionHdr;

/* Map first section */
pSectionHdr = IMAGE_FIRST_SECTION(pNtHdr);
wSections = pNtHdr->FileHeader.NumberOfSections;

for (i = 0; i < wSections; i++)
{
if (pSectionHdr->VirtualAddress <= dwRVA)
if ((pSectionHdr->VirtualAddress + pSectionHdr->Misc.VirtualSize) > dwRVA)
{
dwRVA -= pSectionHdr->VirtualAddress;
  dwRVA += pSectionHdr->PointerToRawData;

return (dwRVA);
}

pSectionHdr++;
}

return (-1);
}

/*----------------------------------------------------------*
*
* OffsetToRVA: Convert value from file offset to RVA.
*----------------------------------------------------------*/
DWORD OffsetToRVA(IMAGE_NT_HEADERS32* pNtHdr, DWORD dwOffset)
{
int i;
WORD wSections;
PIMAGE_SECTION_HEADER pSectionHdr;

/* Map first section */
pSectionHdr = IMAGE_FIRST_SECTION(pNtHdr);
wSections = pNtHdr->FileHeader.NumberOfSections;

for (i = 0; i < wSections; i++)
{
if (pSectionHdr->PointerToRawData <= dwOffset)
if ((pSectionHdr->PointerToRawData + pSectionHdr->SizeOfRawData) > dwOffset)
{
dwOffset -= pSectionHdr->PointerToRawData;
dwOffset += pSectionHdr->VirtualAddress;

return (dwOffset);
}

pSectionHdr++;
}

return (-1);
}
Posted on 2010-01-22 09:55:53 by Scali
Necromancer! ;)
Posted on 2010-01-22 10:51:06 by f0dder