x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 5 Activity

RvaToVa(): use SizeOfRawData instead of VirtualSize as the upper bound on section RVAs. This matches the behaviour of RtlImageRvaToSection for SEC_COMMIT mappings

This commit is contained in:
Mattiwatti 2018-03-20 06:56:16 +01:00 committed by Duncan Ogilvie
parent a4638d2ea9
commit 28c03967c7
No known key found for this signature in database
GPG Key ID: FC89E0AAA0C1AAD8
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/dbg/module.cpp
View File

@ -62,14 +62,13 @@ static NTSTATUS ImageNtHeaders(duint base, duint size, PIMAGE_NT_HEADERS* outHea
static ULONG64 RvaToVa(ULONG64 base, PIMAGE_NT_HEADERS ntHeaders, ULONG64 rva)
{
PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(ntHeaders);
const WORD numSections = ntHeaders->FileHeader.NumberOfSections;
for(WORD i = 0; i < numSections; ++i)
for(WORD i = 0; i < ntHeaders->FileHeader.NumberOfSections; ++i)
{
if(section->VirtualAddress <= rva &&
section->VirtualAddress + section->Misc.VirtualSize > rva)
if(rva >= section->VirtualAddress &&
rva < section->VirtualAddress + section->SizeOfRawData)
{
ASSERT_TRUE(rva != 0); // Following garbage in is garbage out, RVA 0 should always yield VA 0
return base + (rva - section->VirtualAddress + section->PointerToRawData);
return base + (rva - section->VirtualAddress) + section->PointerToRawData;
}
section++;
}