/// The PE format frequently uses the term RVA (Relative Virtual Address). An RVA is the address of an item
/// <i>once loaded into memory</i>, with the base address of the image file subtracted from it (i.e., the offset from the
/// base address where the file is loaded). The RVA of an item will almost always differ from its position within
/// the file on disk. To compute the file position of an item with RVA <i>r</i>, search all the sections in the PE file to find
/// the section with RVA s, length <i>l</i> and file position <i>p </i>in which the RVA lies, ie <i>s ≤ r < s+l</i>. The file position of
/// the item is then given by <i>p+(r-s)</i>.
/// <see cref="c042927_ISO_IEC_23271_2006(E).pdf"/>page 299 of 556.
/// </summary>
/// <param name="rva"></param>
/// <returns></returns>
- public uint Rva2Offset(uint rva) {
if (rva == 0)
return 0;
- else {
- for (int i = 0; i < this.pe.SectionHeaders.Length; i++) {
SectionHeader sh = this.pe.SectionHeaders[i];
if ((sh.VirtualAddress <= rva) && (sh.VirtualAddress + sh.SizeOfRawData > rva))
return (sh.PointerToRawData + (rva - sh.VirtualAddress));
}
}
throw new Exception("Invalid RVA address.");
}