#include<stdio.h>
#include<windows.h>
#include<string.h>
#pragma warning(disable:4996)
DWORD RvaToFoa(DWORD PRVA, PVOID PImageBuffer)
{
PIMAGE_DOS_HEADER PDos_Header = NULL;
PIMAGE_NT_HEADERS PNT_Headers = NULL;
PIMAGE_FILE_HEADER PFile_Header = NULL;
PIMAGE_OPTIONAL_HEADER POptional_Header = NULL;
PIMAGE_SECTION_HEADER PSection_Header = NULL;
if (!PImageBuffer)
{
printf("FileBuffer->ImageBuffer失败\n");
return 0;
}
if (*((PWORD)PImageBuffer) != IMAGE_DOS_SIGNATURE)
{
printf("FileBuffer->ImageBuffer不是有效的MZ标识\n");
return 0;
}
PDos_Header = (PIMAGE_DOS_HEADER)PImageBuffer;
if (*((PWORD)((DWORD)PImageBuffer + PDos_Header->e_lfanew)) != IMAGE_NT_SIGNATURE)
{
printf("FileBuffer->ImageBuffer不是有效的PE文件\n");
return 0;
}
PNT_Headers = (PIMAGE_NT_HEADERS)((DWORD)PImageBuffer + PDos_Header->e_lfanew);
PFile_Header = (PIMAGE_FILE_HEADER)((DWORD)PImageBuffer + PDos_Header->e_lfanew + 4);
POptional_Header = (PIMAGE_OPTIONAL_HEADER)((DWORD)PImageBuffer + PDos_Header->e_lfanew + 0x18);
PSection_Header = (PIMAGE_SECTION_HEADER)((DWORD)POptional_Header + PFile_Header->SizeOfOptionalHeader);
int Image_PianYi = PRVA;
PIMAGE_SECTION_HEADER PTemSection = PSection_Header;
for (DWORD I = 0; I < PFile_Header->NumberOfSections; I++, PTemSection++)
{
if((Image_PianYi>=PTemSection->VirtualAddress)&&(Image_PianYi<(PTemSection->VirtualAddress+PTemSection->Misc.VirtualSize)))
return Image_PianYi-PTemSection->VirtualAddress+PTemSection->PointerToRawData;
}
return 0;
}
DWORD FoaToRva(DWORD PFOA, PVOID PImageBuffer)
{
PIMAGE_DOS_HEADER PDos_Header = NULL;
PIMAGE_NT_HEADERS PNT_Headers = NULL;
PIMAGE_FILE_HEADER PFile_Header = NULL;
PIMAGE_OPTIONAL_HEADER POptional_Header = NULL;
PIMAGE_SECTION_HEADER PSection_Header = NULL;
if (!PImageBuffer)
{
printf("FileBuffer->ImageBuffer失败\n");
return 0;
}
if (*(PWORD)PImageBuffer != IMAGE_DOS_SIGNATURE)
{
printf("FileBuffer->ImageBuffer失败\n");
return 0;
}
PDos_Header = (PIMAGE_DOS_HEADER)PImageBuffer;
if (*(PWORD)PImageBuffer + PDos_Header->e_lfanew != IMAGE_NT_SIGNATURE)
{
printf("FileBuffer->ImageBuffer失败\n");
return 0;
}
PNT_Headers = (PIMAGE_NT_HEADERS)((DWORD)PImageBuffer + PDos_Header->e_lfanew);
PFile_Header = (PIMAGE_FILE_HEADER)((DWORD)PImageBuffer + PDos_Header->e_lfanew + 4);
POptional_Header=(PIMAGE_OPTIONAL_HEADER)((DWORD)PImageBuffer + PDos_Header->e_lfanew + 0x18);
PSection_Header = (PIMAGE_SECTION_HEADER)((DWORD)POptional_Header + PFile_Header->SizeOfOptionalHeader);
DWORD File_PianYi = PFOA;
PIMAGE_SECTION_HEADER PTemSection = PSection_Header;
for (DWORD I = 0; I < PFile_Header->NumberOfSections; I++, PTemSection++)
{
if (File_PianYi >= PTemSection->PointerToRawData && File_PianYi < (PTemSection->PointerToRawData + PTemSection->Misc.VirtualSize));
return File_PianYi - PTemSection->PointerToRawData + PTemSection->VirtualAddress;
}
return 0;
}
最后修改:2020 年 11 月 04 日
© 允许规范转载