How to Convert RVA to Offset ?

August 6, 2011

hi dears

I'm looking for delphi source that convert RVA to Offset. I found some code but those not work and I can't fix them.

please help me to do it.

tnx & sorry for poor english

August 6, 2011

hi dears
I'm looking for delphi source that convert RVA to Offset. I found some code but those not work and I can't fix them.
please help me to do it.
tnx & sorry for poor english

try this:

/>http://www.woodmann.com/forum/archive/index.php/t-5213.html
/>http://www.woodmann.com/forum/archive/index.php/t-1798.html

Hug

August 6, 2011

Try another tip
/>http://www.art0.org/techtips/reversing/portable-executable-converting-rva-to-file-offset-and-back

August 6, 2011

tnx dears but I'm delphi coder and can't understand C++.

I found this function that contain some error in line 29 that can't get sections info !


function RVA2Offset(hFile: THANDLE;RVA: Cardinal): Cardinal;
var
  Base: Pointer;
  ISH : PIMAGESECTIONHEADER;
  INH : PIMAGENTHEADERS;
  hFM : THANDLE;
  x : Integer;
begin
  Result:=0;
  hFM:=CreateFileMapping(hFile,nil,PAGE_READONLY,0,0,nil);
  Base:=MapViewOfFile(hFM,FILE_MAP_READ,0,0,0);  if Base=nil then
  begin
    UnMapViewOfFile(Base);
    CloseHandle(hFM);
    exit;
  end;  INH:=ImageNTHeader(Base);  if INH=nil then
  begin
    UnMapViewOfFile(Base);
    CloseHandle(hFM);
    exit;
  end;  ISH:=ImageRVAToSection(INH,Base,RVA);
  if ISH=nil then
  begin
    UnMapViewOfFile(Base);
    CloseHandle(hFM);
    exit;
  end;  Result:=RVA-ISH.VirtualAddress+ISH.PointerToRawData;
  UnMapViewOfFile(Base);
  CloseHandle(hFM);
end;

August 7, 2011

1) The function you posted comes from this URL: http://pcg.3dn.ru/publ/2-1-0-33 There is complete sample application in that page, it compiles and works just fine. If your code doesn't work, you messed up something yourself.

2) I recommend that you look at the CheatEngine code (http://code.google.com/p/cheat-engine/), it's of much better quality. The function you need is called "VirtualAddressToFileAddress" and it's in the file http://cheat-engine.googlecode.com/svn/trunk/Cheat%20Engine/PEInfoFunctions.pas

Cheers,

kao.

August 9, 2011

hi @kao

1 ==> I'm not changed any line of code (Code not work correctly)

I'm solved it by BruteForce method of offset2RVA.

tnx

August 18, 2011

I'm not understand delphi but try this:


if ((RVA>=Section.rva) and (RVA<=Section.rva+Section.physical_size)) then
z:=Section.physical_offs+RVA-Section.rva;

August 20, 2011

hi dears
I'm looking for delphi source that convert RVA to Offset. I found some code but those not work and I can't fix them.
please help me to do it.
tnx & sorry for poor english

Hi.

Check this out: http://delphi.xcjc.net/viewthread.php?tid=43796

August 22, 2011

Rva2Offset & Offset2Rva, It's here:


///////////////////////////////////////////////////////////////
//   		Coded by vic4key {CiN1}   				//
///////////////////////////////////////////////////////////////Procedure Msg(szType: Byte);
var
  Text: String;
begin
  case szType of
	1, 2: Text:= 'This is not PE files.';
	3:	Text:= 'Error opening file.';
	4:	Text:= 'RVA or Offset is invalid.';
  end;
  MessageBox(0, PChar(Text), PChar('Error'), MB_ICONEXCLAMATION);
  Exit;
end;Function Converter(FileName: String; _type: Byte; Offset, _RVA: Dword): String;
var
  hfile, dwRead:    	Dword;
  _i, _j, _x, _numberSS:	Dword;
  _ret, _save, _rvaCmp: Dword;
  _maxAddr, _minAddr:   Dword;
  SS: Array Of      	TImageSectionHeader;
  IDH:              	TImageDosHeader;
  INtH: 				TImageNtHeaders;
  IFH:              	_IMAGE_FILE_HEADER;
  IOH:              	_IMAGE_OPTIONAL_HEADER;
begin
	hFile:= CreateFile(PChar(FileName),
          	GENERIC_READ or GENERIC_WRITE,
          	FILE_SHARE_READ or FILE_SHARE_WRITE,
          	Nil, OPEN_EXISTING, 0, 0); {Get handle of File.}
	_save:= 0;
  if hFile = INVALID_HANDLE_VALUE then begin Msg(3); Exit; end else
  begin {OpenFile}
    	SetFilePointer(hFile, 0, Nil, FILE_BEGIN);
    	ReadFile(hFile, IDH, 64, dwRead, Nil);      	{*IDH:	DOS Image Header*}
	if IDH.e_magic <> IMAGE_DOS_SIGNATURE then Msg(1) else
	begin {DOS}
    	SetFilePointer(hFile, IDH._lfanew, Nil, FILE_BEGIN);
    	ReadFile(hFile, INtH, 248, dwRead, Nil);    	{*INtH:   NT Image Header*}
	if INtH.Signature <> IMAGE_NT_SIGNATURE then Msg(2) else
  	begin {NT}
    	IFH:= INtH.FileHeader;                      	{*FH: 	FILE Image Header*}
    	IOH:= INtH.OptionalHeader;                  	{*OH: 	OPTIONAL Image Header*}
    	_numberSS:= IFH.NumberOfSections;
    	SetLength(SS, _numberSS); {Set length[max & min] for SS}
    	_x:= IDH._lfanew + 24 + IFH.SizeOfOptionalHeader; {_x = OffsetPEHeaer + 24 + SizeOPHeaer}
    	for _i:= Low(SS) to High(SS) do {Number of (SS[Min = 0] ~> SS[Max])}
      	begin
        	SetFilePointer(hFile, _x, Nil, FILE_BEGIN);
        	ReadFile(hFile, SS[_i], 40, dwRead, Nil);	{*SS[i]:  SECTONS Header*}
        	Inc(_x, 40);
      	end;
      	{*Choose type convert*}
        	_save:= 0;
        	_i:=	0;
        	_ret:=  0;
      	case _type of
        	1:
        	begin
        	{* Offset ~> RVA *}
        	if (Offset >= SS[Low(SS)].PointerToRawData) And (Offset <= SS[High(SS)].PointerToRawData) then
        	begin
        	for _i:= Low(SS) to High(SS) do
        	begin
        	if SS[_i].PointerToRawData > Offset then
          	begin
            	_ret:= _i - 1; {<~ Section contain Offset}
            	Break;
          	end;
        	end;
          	_save:= Offset - SS[_ret].PointerToRawData +
                  	SS[_ret].VirtualAddress + IOH.ImageBase;
        	end
        	else begin _save:= 0; end;
        	end;
        	2:
        	begin
        	{* RVA ~> Offset *}
        	_maxAddr:= SS[High(SS)].VirtualAddress + IOH.ImageBase;
        	_minAddr:= SS[Low(SS)].VirtualAddress + IOH.ImageBase;
        	if (_RVA <= _maxAddr) And (_RVA >= _minAddr) then
        	begin
        	for _i:= Low(SS) to High(SS) do
        	begin
        	_rvaCmp:= SS[_i].VirtualAddress + IOH.ImageBase;
        	if _rvaCmp > _RVA then
          	begin
            	_ret:= _i - 1; {<~ Section contain RVA}
            	Break;
          	end;
        	end;
			_save:= _RVA + SS[_ret].PointerToRawData -
					SS[_ret].VirtualAddress - IOH.ImageBase;
        	end else begin _save:= 0; end;
        	end; {if}
        	end; {2}
  	end; {NT}
	end; {DOS}
  end; {OpenFile}
  PAdressCvter:= _save;
end;

Edited August 28, 2011 by vic4key

September 1, 2011

@vic4key :

tnx dear but your function don't have any result for me & it's contain some bug !

I'm edited it and work !

tnx.


Function Converter(FileName: String; _type: Byte;var Offset: Dword;var _RVA: Dword): String;
var
  hfile, dwRead : Dword;
  _i, _j, _x, _numberSS : Dword;
  _ret, _save, _rvaCmp : Dword;
  _maxAddr, _minAddr : Dword;
  SS : Array Of TImageSectionHeader;
  IDH : TImageDosHeader;
  INtH : TImageNtHeaders;
  IFH : _IMAGE_FILE_HEADER;
  IOH : _IMAGE_OPTIONAL_HEADER;
  x : cardinal;
begin
  hFile:= CreateFile(PChar(FileName), GENERIC_READ or GENERIC_WRITE,
            	FILE_SHARE_READ or FILE_SHARE_WRITE,
            	Nil, OPEN_EXISTING, 0, 0); {Get handle of File.}
  _save:= 0;
  if hFile = INVALID_HANDLE_VALUE then begin Msg(3); Exit; end else
  begin {OpenFile}
	SetFilePointer(hFile, 0, Nil, FILE_BEGIN);
	ReadFile(hFile, IDH, 64, dwRead, Nil);      	{*IDH:  DOS Image Header*}
	if IDH.e_magic <> IMAGE_DOS_SIGNATURE then Msg(1) else
	begin {DOS}
  	SetFilePointer(hFile, IDH._lfanew, Nil, FILE_BEGIN);
  	ReadFile(hFile, INtH, 248, dwRead, Nil);    	{*INtH:   NT Image Header*}
  	if INtH.Signature <> IMAGE_NT_SIGNATURE then Msg(2) else
  	begin {NT}
    	IFH:= INtH.FileHeader;                      	{*FH:   FILE Image Header*}
    	IOH:= INtH.OptionalHeader;                  	{*OH:   OPTIONAL Image Header*}
    	_numberSS:= IFH.NumberOfSections;
    	SetLength(SS, _numberSS); {Set length[max & min] for SS}
    	_x:= IDH._lfanew + 24 + IFH.SizeOfOptionalHeader; {_x = OffsetPEHeaer + 24 + SizeOPHeaer}
    	for _i:= Low(SS) to High(SS) do {Number of (SS[Min = 0] ~> SS[Max])}
    	begin
      	SetFilePointer(hFile, _x, Nil, FILE_BEGIN);
      	ReadFile(hFile, SS[_i], 40, dwRead, Nil);   	{*SS[i]:  SECTONS Header*}
      	Inc(_x, 40);
    	end;
    	{*Choose type convert*}
    	_save:= 0;
    	_i:=	0;
    	_ret:=  0;
    	case _type of
      	1:
      	begin {* Offset ~> RVA *}
        	if (Offset >= SS[Low(SS)].PointerToRawData) And (Offset <= SS[High(SS)].PointerToRawData) then
        	begin
          	for _i:= Low(SS) to High(SS) do
          	begin
            	if SS[_i].PointerToRawData > Offset then
            	begin
              	_ret:= _i - 1; {<~ Section contain Offset}
              	Break;
            	end;
          	end;
          	_save:= Offset - SS[_ret].PointerToRawData +
                    	SS[_ret].VirtualAddress + IOH.ImageBase;
        	end
        	else
          	_save:= 0;
      	end;
      	2:
      	begin {* RVA ~> Offset *}
        	_maxAddr:= SS[High(SS)].VirtualAddress + IOH.ImageBase;
        	_minAddr:= SS[Low(SS)].VirtualAddress + IOH.ImageBase;
        	if (_RVA <= _maxAddr) And (_RVA >= _minAddr) then
        	begin
          	for _i:= Low(SS) to High(SS) do
          	begin
            	_rvaCmp:= SS[_i].VirtualAddress + IOH.ImageBase;
            	if _rvaCmp > _RVA then
            	begin
              	_ret:= _i - 1; {<~ Section contain RVA}
              	Break;
            	end;
          	end;
          	_save:= _RVA + SS[_ret].PointerToRawData -
                       	SS[_ret].VirtualAddress - IOH.ImageBase;
        	end
        	else
          	_save:= 0;
        	end; {if}
      	end; {2}
  	end; {NT}
	end; {DOS}
	closehandle(hfile);
  end; {OpenFile}
  if _type = 1 then
	writeprocessmemory(getcurrentprocess, @_RVA, @_save, sizeof(_save), x)
  else if _type = 2 then
	writeprocessmemory(getcurrentprocess, @Offset, @_save, sizeof(_save), x);
  //PAdressCvter := _save;
end;

September 3, 2011

OK,

Sign In

How to Convert RVA to Offset ?

Recommended Posts

h4sh3m

C0M3ND4D0R

skypeaful

h4sh3m

kao

h4sh3m

NikolayD

Jaymz

Vic

h4sh3m

Vic

Create an account or sign in to comment

Create an account

Sign in

Community

Search