Skip to main content
Reverse Engineering

Return to Question

edited title
Link
SSpoke
SSpoke
  • 759
  • 1
  • 7
  • 19

How do you calculate Address Start / Size of PE Section like .rdata / .rdatadata

added 6 characters in body; edited title
Source Link
SSpoke
SSpoke
  • 759
  • 1
  • 7
  • 19

How do you calculate Address Start / Size of PE Section like .rdata / .rdata

Dim LastAddress As Long
'Dim AddressOfPE As Long
AddressOfPE = NTHEADER.OptionalHeader.ImageBase
LastAddress = AddressOfPE

    For u = 0 To UBound(SECTIONSHEADER)
        LastAddressAddressStart = LastAddressAddressOfPE + SECTIONSHEADER(u).VirtualAddress
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & "_
 Last Address  " AddressStart = " & Hex(LastAddressAddressStart) & _
    " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & _
    " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
  & _
    " SizeOfRawData = 'Hunt" for& stringsHex(SECTIONSHEADER(u).SizeOfRawData)
    'Hunt for strings
    If SECTIONSHEADER(u).nameSec = ".rdata" Or SECTIONSHEADER(u).nameSec = ".data" Then
            MsgBox "a"
        End If
        LastAddressAddressEnd = LastAddressAddressStart + SECTIONSHEADER(u).VirtualSizeSizeOfRawData
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & "_
 Last Address = " & HexAddressEnd(LastAddress?) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddressAddressEnd) & _
    " VirtualSizeOllyAddressEnd(?) = " & Hex(SECTIONSHEADER(u).VirtualSizeSizeOfRawData)
    Next u

(0) .text  Last AddressAddressStart = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD SizeOfRawData = 1FAB400
(0) .text  Last Address = 23AC3AD VirtualAddressAddressEnd(?) = 100023AC400 VirtualSizeOllyAddressEnd(?) = 1FAB3AD1FAB400
(1) .rdata Last AddressAddressStart = 43593AD23AD000 VirtualAddress = 1FAD000 VirtualSize = 855586 SizeOfRawData = 855600
(1) .rdata Last Address = 4BAE933 VirtualAddressAddressEnd(?) = 1FAD0002C02600 VirtualSizeOllyAddressEnd(?) = 855586855600
(2) .data  Last AddressAddressStart = 73B19332C03000 VirtualAddress = 2803000 VirtualSize = 2D045C4 SizeOfRawData = 1DF000
(2) .data  Last Address = A0B5EF7 VirtualAddressAddressEnd(?) = 28030002DE2000 VirtualSizeOllyAddressEnd(?) = 2D045C41DF000
(3) .rsrc  Last AddressAddressStart = F5BDEF75908000 VirtualAddress = 5508000 VirtualSize = 105CC SizeOfRawData = 10600
(3) .rsrc  Last Address = F5CE4C3 VirtualAddressAddressEnd(?) = 55080005918600 VirtualSizeOllyAddressEnd(?) = 105CC10600

Looking at this image seems I got it all right? but the size addresses are still off? .

pe101 image

How do you calculate Address Start of PE Section like .rdata / .rdata

Dim LastAddress As Long
'Dim AddressOfPE As Long
AddressOfPE = NTHEADER.OptionalHeader.ImageBase
LastAddress = AddressOfPE

    For u = 0 To UBound(SECTIONSHEADER)
        LastAddress = LastAddress + SECTIONSHEADER(u).VirtualAddress
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & " Last Address = " & Hex(LastAddress) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
         'Hunt for strings
        If SECTIONSHEADER(u).nameSec = ".rdata" Or SECTIONSHEADER(u).nameSec = ".data" Then
            MsgBox "a"
        End If
        LastAddress = LastAddress + SECTIONSHEADER(u).VirtualSize
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & " Last Address = " & Hex(LastAddress) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
    Next u

(0) .text  Last Address = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD
(0) .text  Last Address = 23AC3AD VirtualAddress = 1000 VirtualSize = 1FAB3AD
(1) .rdata Last Address = 43593AD VirtualAddress = 1FAD000 VirtualSize = 855586
(1) .rdata Last Address = 4BAE933 VirtualAddress = 1FAD000 VirtualSize = 855586
(2) .data  Last Address = 73B1933 VirtualAddress = 2803000 VirtualSize = 2D045C4
(2) .data  Last Address = A0B5EF7 VirtualAddress = 2803000 VirtualSize = 2D045C4
(3) .rsrc  Last Address = F5BDEF7 VirtualAddress = 5508000 VirtualSize = 105CC
(3) .rsrc  Last Address = F5CE4C3 VirtualAddress = 5508000 VirtualSize = 105CC

Looking at this image seems I got it all right? but the addresses are still off? pe101 image

How do you calculate Address Start / Size of PE Section like .rdata / .rdata

For u = 0 To UBound(SECTIONSHEADER)
    AddressStart = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & _
    " AddressStart = " & Hex(AddressStart) & _
    " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & _
    " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize) & _
    " SizeOfRawData = " & Hex(SECTIONSHEADER(u).SizeOfRawData)
    'Hunt for strings
    If SECTIONSHEADER(u).nameSec = ".rdata" Or SECTIONSHEADER(u).nameSec = ".data" Then
        MsgBox "a"
    End If
    AddressEnd = AddressStart + SECTIONSHEADER(u).SizeOfRawData
    Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & _
    " AddressEnd(?) = " & Hex(AddressEnd) & _
    " OllyAddressEnd(?) = " & Hex(SECTIONSHEADER(u).SizeOfRawData)
Next u

(0) .text  AddressStart = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD SizeOfRawData = 1FAB400
(0) .text  AddressEnd(?) = 23AC400 OllyAddressEnd(?) = 1FAB400
(1) .rdata AddressStart = 23AD000 VirtualAddress = 1FAD000 VirtualSize = 855586 SizeOfRawData = 855600
(1) .rdata AddressEnd(?) = 2C02600 OllyAddressEnd(?) = 855600
(2) .data  AddressStart = 2C03000 VirtualAddress = 2803000 VirtualSize = 2D045C4 SizeOfRawData = 1DF000
(2) .data  AddressEnd(?) = 2DE2000 OllyAddressEnd(?) = 1DF000
(3) .rsrc  AddressStart = 5908000 VirtualAddress = 5508000 VirtualSize = 105CC SizeOfRawData = 10600
(3) .rsrc  AddressEnd(?) = 5918600 OllyAddressEnd(?) = 10600

Looking at this image seems I got it all right? but the size addresses are off.

pe101 image

added 153 characters in body
Source Link
SSpoke
SSpoke
  • 759
  • 1
  • 7
  • 19

I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.

I started of with trying to map the memory map's addresses exactly the same way ollydbg does it.

ollyview

The PE header is at 0x00400000 with Size 0x1000

I assume the 0x00400000 is retrieved like so.

Dim AddressOfPE As Long = NTHEADER.OptionalHeader.ImageBase

Now I want to map the addresses for all the other stuff most importantly .text .rdata but I wouldn't mind having them all.

what I tried is this

Dim LastAddress As Long
'Dim AddressOfPE As Long
AddressOfPE = NTHEADER.OptionalHeader.ImageBase
LastAddress = AddressOfPE

    For u = 0 To UBound(SECTIONSHEADER)
        LastAddress = LastAddress + SECTIONSHEADER(u).VirtualAddress
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & " Last Address = " & Hex(LastAddress) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
        'Hunt for strings
        If SECTIONSHEADER(u).nameSec = ".rdata" Or SECTIONSHEADER(u).nameSec = ".data" Then
            MsgBox "a"
        End If
        LastAddress = LastAddress + SECTIONSHEADER(u).VirtualSize
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & " Last Address = " & Hex(LastAddress) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
    Next u

Debug log looks like this

(0) .text  Last Address = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD
(0) .text  Last Address = 23AC3AD VirtualAddress = 1000 VirtualSize = 1FAB3AD
(1) .rdata Last Address = 43593AD VirtualAddress = 1FAD000 VirtualSize = 855586
(1) .rdata Last Address = 4BAE933 VirtualAddress = 1FAD000 VirtualSize = 855586
(2) .data  Last Address = 73B1933 VirtualAddress = 2803000 VirtualSize = 2D045C4
(2) .data  Last Address = A0B5EF7 VirtualAddress = 2803000 VirtualSize = 2D045C4
(3) .rsrc  Last Address = F5BDEF7 VirtualAddress = 5508000 VirtualSize = 105CC
(3) .rsrc  Last Address = F5CE4C3 VirtualAddress = 5508000 VirtualSize = 105CC

Looking at this image seems I got it all right? but the addresses are still off? pe101 image

I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.

I started of with trying to map the memory map's addresses exactly the same way ollydbg does it.

ollyview

The PE header is at 0x00400000 with Size 0x1000

I assume the 0x00400000 is retrieved like so.

Dim AddressOfPE As Long = NTHEADER.OptionalHeader.ImageBase

Now I want to map the addresses for all the other stuff most importantly .text .rdata but I wouldn't mind having them all.

what I tried is this

Dim LastAddress As Long
'Dim AddressOfPE As Long
AddressOfPE = NTHEADER.OptionalHeader.ImageBase
LastAddress = AddressOfPE

    For u = 0 To UBound(SECTIONSHEADER)
        LastAddress = LastAddress + SECTIONSHEADER(u).VirtualAddress
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & " Last Address = " & Hex(LastAddress) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
        'Hunt for strings
        If SECTIONSHEADER(u).nameSec = ".rdata" Or SECTIONSHEADER(u).nameSec = ".data" Then
            MsgBox "a"
        End If
        LastAddress = LastAddress + SECTIONSHEADER(u).VirtualSize
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & " Last Address = " & Hex(LastAddress) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
    Next u

Debug log looks like this

(0) .text  Last Address = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD
(0) .text  Last Address = 23AC3AD VirtualAddress = 1000 VirtualSize = 1FAB3AD
(1) .rdata Last Address = 43593AD VirtualAddress = 1FAD000 VirtualSize = 855586
(1) .rdata Last Address = 4BAE933 VirtualAddress = 1FAD000 VirtualSize = 855586
(2) .data  Last Address = 73B1933 VirtualAddress = 2803000 VirtualSize = 2D045C4
(2) .data  Last Address = A0B5EF7 VirtualAddress = 2803000 VirtualSize = 2D045C4
(3) .rsrc  Last Address = F5BDEF7 VirtualAddress = 5508000 VirtualSize = 105CC
(3) .rsrc  Last Address = F5CE4C3 VirtualAddress = 5508000 VirtualSize = 105CC

I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.

I started of with trying to map the memory map's addresses exactly the same way ollydbg does it.

ollyview

The PE header is at 0x00400000 with Size 0x1000

I assume the 0x00400000 is retrieved like so.

Dim AddressOfPE As Long = NTHEADER.OptionalHeader.ImageBase

Now I want to map the addresses for all the other stuff most importantly .text .rdata but I wouldn't mind having them all.

what I tried is this

Dim LastAddress As Long
'Dim AddressOfPE As Long
AddressOfPE = NTHEADER.OptionalHeader.ImageBase
LastAddress = AddressOfPE

    For u = 0 To UBound(SECTIONSHEADER)
        LastAddress = LastAddress + SECTIONSHEADER(u).VirtualAddress
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & " Last Address = " & Hex(LastAddress) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
        'Hunt for strings
        If SECTIONSHEADER(u).nameSec = ".rdata" Or SECTIONSHEADER(u).nameSec = ".data" Then
            MsgBox "a"
        End If
        LastAddress = LastAddress + SECTIONSHEADER(u).VirtualSize
        Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & " Last Address = " & Hex(LastAddress) & " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize)
    Next u

Debug log looks like this

(0) .text  Last Address = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD
(0) .text  Last Address = 23AC3AD VirtualAddress = 1000 VirtualSize = 1FAB3AD
(1) .rdata Last Address = 43593AD VirtualAddress = 1FAD000 VirtualSize = 855586
(1) .rdata Last Address = 4BAE933 VirtualAddress = 1FAD000 VirtualSize = 855586
(2) .data  Last Address = 73B1933 VirtualAddress = 2803000 VirtualSize = 2D045C4
(2) .data  Last Address = A0B5EF7 VirtualAddress = 2803000 VirtualSize = 2D045C4
(3) .rsrc  Last Address = F5BDEF7 VirtualAddress = 5508000 VirtualSize = 105CC
(3) .rsrc  Last Address = F5CE4C3 VirtualAddress = 5508000 VirtualSize = 105CC

Looking at this image seems I got it all right? but the addresses are still off? pe101 image

deleted 20 characters in body
Source Link
SSpoke
SSpoke
  • 759
  • 1
  • 7
  • 19
Source Link
SSpoke
SSpoke
  • 759
  • 1
  • 7
  • 19