转换原理

#include<stdio.h>
#include<windows.h>
#include<string.h>
#pragma warning(disable:4996)
DWORD RvaToFoa(DWORD PRVA, PVOID PImageBuffer)
{
    PIMAGE_DOS_HEADER PDos_Header = NULL;
    PIMAGE_NT_HEADERS PNT_Headers = NULL;
    PIMAGE_FILE_HEADER PFile_Header = NULL;
    PIMAGE_OPTIONAL_HEADER POptional_Header = NULL;
    PIMAGE_SECTION_HEADER PSection_Header = NULL;
    if (!PImageBuffer)
    {
        printf("FileBuffer->ImageBuffer失败\n");
        return 0;
    }
    if (*((PWORD)PImageBuffer) != IMAGE_DOS_SIGNATURE)
    {
        printf("FileBuffer->ImageBuffer不是有效的MZ标识\n");
        return 0;
    }
    PDos_Header = (PIMAGE_DOS_HEADER)PImageBuffer;
    if (*((PWORD)((DWORD)PImageBuffer + PDos_Header->e_lfanew)) != IMAGE_NT_SIGNATURE)
    {
        printf("FileBuffer->ImageBuffer不是有效的PE文件\n");
        return 0;
    }
    PNT_Headers = (PIMAGE_NT_HEADERS)((DWORD)PImageBuffer + PDos_Header->e_lfanew);
    PFile_Header = (PIMAGE_FILE_HEADER)((DWORD)PImageBuffer + PDos_Header->e_lfanew + 4);
    POptional_Header = (PIMAGE_OPTIONAL_HEADER)((DWORD)PImageBuffer + PDos_Header->e_lfanew + 0x18);
    PSection_Header = (PIMAGE_SECTION_HEADER)((DWORD)POptional_Header + PFile_Header->SizeOfOptionalHeader);
    int Image_PianYi = PRVA;
    PIMAGE_SECTION_HEADER PTemSection = PSection_Header;
    for (DWORD I = 0; I < PFile_Header->NumberOfSections; I++, PTemSection++)
    {
        if((Image_PianYi>=PTemSection->VirtualAddress)&&(Image_PianYi<(PTemSection->VirtualAddress+PTemSection->Misc.VirtualSize)))
            return Image_PianYi-PTemSection->VirtualAddress+PTemSection->PointerToRawData;
    }
    return 0;
}
DWORD FoaToRva(DWORD PFOA, PVOID PImageBuffer)
{
    PIMAGE_DOS_HEADER PDos_Header = NULL;
    PIMAGE_NT_HEADERS PNT_Headers = NULL;
    PIMAGE_FILE_HEADER PFile_Header = NULL;
    PIMAGE_OPTIONAL_HEADER POptional_Header = NULL;
    PIMAGE_SECTION_HEADER PSection_Header = NULL;
    if (!PImageBuffer)
    {
        printf("FileBuffer->ImageBuffer失败\n");
        return 0;
    }
    if (*(PWORD)PImageBuffer != IMAGE_DOS_SIGNATURE)
    {
        printf("FileBuffer->ImageBuffer失败\n");
        return 0;
    }
    PDos_Header = (PIMAGE_DOS_HEADER)PImageBuffer;
    if (*(PWORD)PImageBuffer + PDos_Header->e_lfanew != IMAGE_NT_SIGNATURE)
    {
        printf("FileBuffer->ImageBuffer失败\n");
        return 0;
    }
    PNT_Headers = (PIMAGE_NT_HEADERS)((DWORD)PImageBuffer + PDos_Header->e_lfanew);
    PFile_Header = (PIMAGE_FILE_HEADER)((DWORD)PImageBuffer + PDos_Header->e_lfanew + 4);
    POptional_Header=(PIMAGE_OPTIONAL_HEADER)((DWORD)PImageBuffer + PDos_Header->e_lfanew + 0x18);
    PSection_Header = (PIMAGE_SECTION_HEADER)((DWORD)POptional_Header + PFile_Header->SizeOfOptionalHeader);
    DWORD File_PianYi = PFOA;
    PIMAGE_SECTION_HEADER PTemSection = PSection_Header;
    for (DWORD I = 0; I < PFile_Header->NumberOfSections; I++, PTemSection++)
    {
        if (File_PianYi >= PTemSection->PointerToRawData && File_PianYi < (PTemSection->PointerToRawData + PTemSection->Misc.VirtualSize));
        return File_PianYi - PTemSection->PointerToRawData + PTemSection->VirtualAddress;
    }
    return 0;
}    
最后修改:2020 年 11 月 04 日
如果觉得我的文章对你有用,请随意赞赏