How can I determine the image address (byte offset in file) of a particular data directory in a PE file?
For example, given data directories as follows:
directory 1 RVA: 0x0 Size: 0
directory 2 RVA: 0xaf974 Size: 300
directory 3 RVA: 0xb8000 Size: 22328
directory 4 RVA: 0x0 Size: 0
directory 5 RVA: 0xc0800 Size: 6440
directory 6 RVA: 0xbe000 Size: 27776
directory 7 RVA: 0x91760 Size: 28
directory 8 RVA: 0x0 Size: 0
directory 9 RVA: 0x0 Size: 0
directory 10 RVA: 0x0 Size: 0
directory 11 RVA: 0xa46b8 Size: 64
directory 12 RVA: 0x0 Size: 0
directory 13 RVA: 0x91000 Size: 1736
directory 14 RVA: 0x0 Size: 0
directory 15 RVA: 0x0 Size: 0
directory 16 RVA: 0x0 Size: 0
The import directory (#2 above) is shown as being at an RVA of 0xAF974. However, the import directory is NOT located at byte 0xAF974 of the EXE file. How do I compute the byte offset of the import directory in the file as it is written on the disk?
This is fun! You have to loop through sections to find the correct location based on it's virtual address. Here is some code I wrote after a lot of
I can try to explain this, but it took a lot of time to understand it myself and I haven't looked at it in a few weeks and I already forgot a lot of the technical stuff. I was writing a C++ class to handle a lot of this too
In my code buffer is a pointer to a MapViewOfFile but it can be any char pointer.