Skip to content

Instantly share code, notes, and snippets.

@akkuman
Last active Nov 3, 2021
Embed
What would you like to do?
[golang实现的pe的rva2foa] #pe #golang
package main
import (
"debug/pe"
"fmt"
"math/big"
"os"
)
func RVA2FOA(pefile *pe.File, rva uint32) (foa uint32, err error) {
for i := 0; i < int(pefile.NumberOfSections); i++ {
if rva >= pefile.Sections[i].VirtualAddress && rva <= pefile.Sections[i].VirtualAddress+pefile.Sections[i].Size {
foa = rva - pefile.Sections[i].VirtualAddress + pefile.Sections[i].Offset
return
}
}
err = fmt.Errorf("Could not find the foa for rva")
return
}
func main() {
pefile, err := pe.Open(os.Args[1])
if err != nil {
fmt.Println(err)
return
}
rva := new(big.Int)
rva.SetString(os.Args[2], 16)
foa, err := RVA2FOA(pefile, uint32(rva.Uint64()))
fmt.Printf("FOA: 0x%x", foa)
}
/*
usage: main.exe target.exe RVAAddress
example:
> main.exe 360zip.exe 113a98
FOA: 0x10da98
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment