[golang实现的pe的rva2foa] #pe #golang

rva2foa.go

package main

import (
	"debug/pe"
	"fmt"
	"math/big"
	"os"
)

func RVA2FOA(pefile *pe.File, rva uint32) (foa uint32, err error) {
	for i := 0; i < int(pefile.NumberOfSections); i++ {
		if rva >= pefile.Sections[i].VirtualAddress && rva <= pefile.Sections[i].VirtualAddress+pefile.Sections[i].Size {
			foa = rva - pefile.Sections[i].VirtualAddress + pefile.Sections[i].Offset
			return
		}
	}
	err = fmt.Errorf("Could not find the foa for rva")
	return
}

func main() {
	pefile, err := pe.Open(os.Args[1])
	if err != nil {
		fmt.Println(err)
		return
	}
	rva := new(big.Int)
	rva.SetString(os.Args[2], 16)
	foa, err := RVA2FOA(pefile, uint32(rva.Uint64()))
	fmt.Printf("FOA: 0x%x", foa)
}


/*
usage: main.exe target.exe RVAAddress

example:
> main.exe 360zip.exe 113a98
FOA: 0x10da98
*/