PIMAGE_SECTION_HEADER __stdcall ImageRvaToSection(PIMAGE_NT_HEADERS NtHeaders, PVOID Base, ULONG Rva)
{
  PIMAGE_SECTION_HEADER pSectionHeader; // eax@1
  unsigned int numberOfSections; // ecx@1
  unsigned int currentSection; // esi@1
  DWORD currentSectionRva; // edx@2

  pSectionHeader = (PIMAGE_SECTION_HEADER)((char *)&NtHeaders->OptionalHeader
                                         + NtHeaders->FileHeader.SizeOfOptionalHeader);
  numberOfSections = NtHeaders->FileHeader.NumberOfSections;
  currentSection = 0;
  if ( numberOfSections )
  {
    while ( 1 )
    {
      currentSectionRva = pSectionHeader->VirtualAddress;
      if ( Rva >= currentSectionRva )
      {
        if ( Rva < currentSectionRva + pSectionHeader->SizeOfRawData )
          break;
      }
      ++pSectionHeader;
      ++currentSection;
      if ( currentSection >= numberOfSections )
        goto LABEL_5;
    }
  }
  else
  {
LABEL_5:
    pSectionHeader = 0;
  }
  return pSectionHeader;
}

PVOID __stdcall ImageRvaToVa(PIMAGE_NT_HEADERS NtHeaders, PVOID Base, ULONG Rva, PIMAGE_SECTION_HEADER *LastRvaSection)
{
  ULONG v4; // edi@1
  PIMAGE_SECTION_HEADER *ppLastSectionHeader; // esi@1
  PIMAGE_SECTION_HEADER pSectionHeader; // ecx@2
  ULONG currentRva; // eax@3
  PVOID result; // eax@9

  ppLastSectionHeader = LastRvaSection;
  v4 = Rva;
  if ( !LastRvaSection
    || (pSectionHeader = *LastRvaSection, !*LastRvaSection)
    || (currentRva = pSectionHeader->VirtualAddress, Rva < currentRva)
    || Rva >= currentRva + pSectionHeader->SizeOfRawData )
    pSectionHeader = ImageRvaToSection(NtHeaders, Base, Rva);
  if ( pSectionHeader )
  {
    if ( ppLastSectionHeader )
      *ppLastSectionHeader = pSectionHeader;
    result = Base + pSectionHeader->PointerToRawData - pSectionHeader->VirtualAddress + v4;
  }
  else
  {
    result = 0;
  }
  return result;
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课