C / C++ / MFC

How to convert RVA to File Offset in a PE file?

27-Jan-09 22:21

I know there is 3 possible view states for any file in the windows explorer:

1) Thumbnails OR Tiles view
2) Icons
3) List OR Details

But within a PE file, there are more icons than this number. How can I realize which one or group of them is/are shown by the windows explorer?

Thank you masters!

Joseph Marzbani27-Jan-09 21:53

Re: How to convert RVA to File Offset in a PE file?

27-Jan-09 21:53

Could you please direct me to a link or something to convert an RVA to File Offset in a PE file format? (Much better in the case of a Fuction or Class or something)

Thank you masters!

epitalon27-Jan-09 22:14

epitalon

27-Jan-09 22:14

If you google the words "RVA File Offset PE", you'll get this link :
http://www.windowsitlibrary.com/Content/356/11/1.html[^]

It seems to contain good starting information...

Re: How to convert RVA to File Offset in a PE file?

Joseph Marzbani27-Jan-09 22:26

Re: How to convert RVA to File Offset in a PE file?

27-Jan-09 22:26

I've read it before! If you would read that you'd realize there's nothing to convert in that article but RVA to VA and NOT file offset!

Thank you anyway 4 Ur attention.

Garth J Lancaster27-Jan-09 22:35

Garth J Lancaster

27-Jan-09 22:35

Im pretty sure PEDUMP from here http://www.wheaty.net/[^] does it, as does 'Ofs' from here http://www.pelib.com/examples.php[^]

There were also some articles here on CP, that did this sort of thing - the articles that dealt with injection etc.

'g'

Re: How to convert RVA to File Offset in a PE file?

Joseph Marzbani28-Jan-09 3:33

Re: File handling in DLL.

28-Jan-09 3:33

www.pelib.com is perfect. Thnx to introduce it.

File handling in DLL.

sam_psycho27-Jan-09 21:44

sam_psycho

27-Jan-09 21:44

Hi,
I have exported one function from DLL, in that i am using "CFile fileObj", but compiler giving error:
CFile:undeclared indentifier , so is it possible to use file handling in DLL? what is the solution for that? Smile | :)

«_Superman_»27-Jan-09 22:19

Re: File handling in DLL.

27-Jan-09 22:19

To use CFile, the DLL must be an MFC DLL.
Or you need to give MFC support to the DLL.

«_Superman_»

Rajesh R Subramanian28-Jan-09 5:29

Rajesh R Subramanian

28-Jan-09 5:29

I'm giving you a 5 for answering a question like that. You have an awful lot of patience. Smile | :)

It is a crappy thing, but it's life -^ Carlo Pallini

Re: File handling in DLL.

«_Superman_»28-Jan-09 17:09

Best way to pass arguments into a method

28-Jan-09 17:09

Thank you Rajesh.
That is very kind of you. Smile | :)

«_Superman_»

CodingLover27-Jan-09 21:32

27-Jan-09 21:32

Hi all,

I have 6 int values and a char buffer to pass another method. Something like this.

<br />
int MyClassOne::Method()<br />
{<br />
    NemMwthod(1, 2, 3, 4, 5, 6, buffer);<br />
}<br />
<br />
int MyClassTwo::NewMethod(int a, int b, int c, int d, int e, int f, char buffer)<br />
{<br />
    // Do the process<br />
}<br />

Seems it's odd to me. So I do the following.

int MyClassOne::Method()<br />
{<br />
    int* arr = new int[6];<br />
    arr[0] = 1;<br />
    arr[1] = 2;<br />
    arr[2] = 3;<br />
    arr[3] = 4;<br />
    arr[4] = 5<br />
    arr[5] = 6;<br />
    <br />
    NemMwthod(arr, buffer);<br />
    delete[] arr;<br />
}<br />
<br />
int MyClassTwo::NewMethod(int ar[], char buffer)<br />
{<br />
    // Do the process<br />
}

I want to know what's best way to workaround is.

Thanks a lot

I appreciate your help all the time...
CodingLover Smile | :)

epitalon27-Jan-09 21:47

epitalon

27-Jan-09 21:47

In my opinion, both methods are good.
I would prefer the first one, because it involves less copy operations.
As long as there is a fixed low number of integers to pass to the called procedure, the fist one is the best.
If the number of integers is variable, the second one is better.

An intermediate method would be:

int arr[6];
arr[0] = 1;
arr[1] = 2;
arr[2] = 3;
arr[3] = 4;
arr[4] = 5
arr[5] = 6;

NemMwthod(arr, buffer);

Rahul Vaishnav27-Jan-09 21:49

Rahul Vaishnav

27-Jan-09 21:49

You can use
vector or CSimpleArray and pass that as a function parameter.

CPallini27-Jan-09 21:50

CPallini

27-Jan-09 21:50

They are both legitimate, anyway IMHO the first one is more reliable, since the second one may crash your application if the caller passes an array having the wrong number of items (i.e. array size < 6).
Note that you may force the correct behaviour this way:

struct MyMethodArg
{
 int arr[6];
 char * buffer; // Usual a character buffer 
};

int MyClass::MyMethod(MyMethodArg arg)
{

}

If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.

This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke

[My articles]

CodingLover27-Jan-09 22:23

27-Jan-09 22:23

Thanks for all the comments, make sense.

But actually that method is call large number of times, say 50 times in one second. The way I workout is fine? I'm testing it, so far so good. Smile | :)

I appreciate your help all the time...
CodingLover Smile | :)

CPallini27-Jan-09 22:27

CPallini

27-Jan-09 22:27

Which way?
If you use the array then you may choose to allocate it on the stack, instead of the heap, for instance

int a[]={1,2,3,4,5,6};
MyMethod(a,buf);

CodingLover27-Jan-09 22:31

27-Jan-09 22:31

Ya, but I've clear the head once pass the array.

I appreciate your help all the time...
CodingLover Smile | :)

CPallini27-Jan-09 22:39

CPallini

27-Jan-09 22:39

CodingLover wrote:
Ya, but I've clear the head once pass the array.

CodingLover27-Jan-09 22:47

27-Jan-09 22:47

Sorry sir, it should be heap.

I appreciate your help all the time...
CodingLover Smile | :)

«_Superman_»27-Jan-09 22:25

27-Jan-09 22:25

CodingLover wrote:
I want to know what's best way

Both are fine. Normally what I do is that if a function needs more than 5 parameters, I define a structure for it. It is just a standard that I follow. So its all up to you.

All parameters are passed on the stack and in Visual Studio the default stack space for a thread is 1 MB. So passing a structure will only use one location of the stack rather than 100 locations if you want to pass 100 parameters.

«_Superman_»

CodingLover27-Jan-09 22:31

27-Jan-09 22:31

Actually those methods are in two different classes. Sorry about that, I'm asking it because I've no more knowledge about structures. Is that structures is possible here.

I appreciate your help all the time...
CodingLover Smile | :)

«_Superman_»27-Jan-09 22:42

27-Jan-09 22:42

You can define the structure in a header file and include the header file in both the class files.

«_Superman_»