char* RvaToRaw(char* pFile,DWORD rva) { IMAGE_DOS_HEADER* pdh=(IMAGE_DOS_HEADER*)pFile; IMAGE_NT_HEADERS* pnh=(IMAGE_NT_HEADERS*)(pFile+pdh->e_lfanew); DWORD sectionnum=pnh->FileHeader.NumberOfSections; IMAGE_SECTION_HEADER* psh=(IMAGE_SECTION_HEADER*)(pnh+1); for(DWORD i=0;i<sectionnum;i++) { if(psh[i].VirtualAddress<=rva&&rva<=(psh[i].VirtualAddress+psh[i].SizeOfRawData)) { DWORD radr=rva-psh[i].VirtualAddress+psh[i].PointerToRawData; return (pFile+radr); } } return NULL; }
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!