滴水三期逆向基础系列(番外)-RVA转FOA

size_t RVAToFOA(
	size_t x,
	PVOID memoryBuff
){
	
	PIMAGE_DOS_HEADER idh = NULL;
	PIMAGE_NT_HEADERS inh = NULL;
	PIMAGE_FILE_HEADER ifh = NULL;
	PIMAGE_OPTIONAL_HEADER ioh = NULL;
	PIMAGE_SECTION_HEADER ish = NULL;

	idh = (PIMAGE_DOS_HEADER)memoryBuff;
	inh = (PIMAGE_NT_HEADERS)((BYTE *)memoryBuff + idh->e_lfanew);
	ifh = (PIMAGE_FILE_HEADER)((BYTE *)inh + sizeof(DWORD));
	ioh = (PIMAGE_OPTIONAL_HEADER)((BYTE *)ifh + IMAGE_SIZEOF_FILE_HEADER);
	ish = (PIMAGE_SECTION_HEADER)((BYTE *)ioh + ifh->SizeOfOptionalHeader);

	DWORD sectionCount = inh->FileHeader.NumberOfSections;
	DWORD memoryAli = inh->OptionalHeader.SectionAlignment;
	//DWORD RVA = x - ioh->ImageBase;
	DWORD RVA = x;
	if(RVA < ((DWORD)ish - (DWORD)memoryBuff)) return RVA;

	for(DWORD i = 0;i < sectionCount ; i++){
		PIMAGE_SECTION_HEADER tmpSec = (ish + i);
		if( RVA  >= tmpSec->VirtualAddress  && RVA <= (tmpSec->VirtualAddress + tmpSec->SizeOfRawData)){
			return tmpSec->PointerToRawData + (RVA - tmpSec->VirtualAddress);
		}
	}

	return ERROR;
}

1.计算RVA 公式：    x - ImageBase = RVA

2.计算差值偏移：    RVA - 第N节.VirtualAddress = 偏移

3.计算FOA：           偏移 + 第N节.PointerToRawData = FOA

如果RVA在DOS头和NT头中，那么就不用计算了。