RVAToOffset

[StoneHeart]

I'am getting a problem getting the value of RVAToOffset for compiled vc2010 exe. Some of RVAs return 0 offset.

Example usage:

entrypoint = RvaToOffset(pe.OptionalHeader.AddressOfEntryPoint)
RawOffset = RvaToOffset(sect.PointerToRawData)

entrypoint ok
RawOffset not ok ie 0

Some exe works well ie compiled vb6 and vc6 exe but vc2010 compiled exe doesn't work.

What could be the problem? Does exe pe info on compiled vc2010 is different from exe compiled on vb6/vc6?

Does this code works for you?

/*----------------------------------------------------------*
 *
 * RVAToOffset: Convert value from RVA to file offset.
 *----------------------------------------------------------*/
 DWORD RVAToOffset(IMAGE_NT_HEADERS32* pNtHdr, DWORD dwRVA)
 {
 	int i;
 	WORD wSections;
 	PIMAGE_SECTION_HEADER pSectionHdr;
 
 	/* Map first section */
 	pSectionHdr = IMAGE_FIRST_SECTION(pNtHdr);
 	wSections = pNtHdr->FileHeader.NumberOfSections;
 
 	for (i = 0; i < wSections; i++)
 	{
 		if (pSectionHdr->VirtualAddress <= dwRVA)
 			if ((pSectionHdr->VirtualAddress + pSectionHdr->Misc.VirtualSize) > dwRVA)
 			{
 				dwRVA -= pSectionHdr->VirtualAddress;
  				dwRVA += pSectionHdr->PointerToRawData;
 
 				return (dwRVA);
 			}
 
 		pSectionHdr++;
 	}
 
 	return (0);
 }

[JLBorges]

> DWORD RVAToOffset(IMAGE_NT_HEADERS32* pNtHdr, DWORD dwRVA)
> Some exe works well ie compiled vb6 and vc6 exe but vc2010 compiled exe doesn't work

64-bit image, perhaps?

[StoneHeart]

No. It isn't a 64-bit exe.

I still haven't found any solution for this problem yet and i'm still trying...