Home > Uncategorized > Get RVA for offset in exe

Get RVA for offset in exe

if you want to know where a particular sequence of byte will be loaded at run time in memory and you only have there offset from 0 position in exe file then use following:

  1. open exe and check sections tables
  2. check which section this offset belong to.
  3. load exe and get base address.
  4. you can calculate offset as below:
    1. RVA = offset in exe – rawaddress from section + virtual address + base address of exe
Advertisements
Categories: Uncategorized
  1. No comments yet.
  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: