Return to Answer

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved.

Dim AddressOfPE As Long
Dim RawFileOffsetToCheck As Long
Dim StartAddress as Long
Dim EndAddresss as Long   

AddressOfPE = NTHEADER.OptionalHeader.ImageBase

For u = 0 To UBound(SECTIONSHEADER)
    StartAddress = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    EndAddresss = RoundUp((SECTIONSHEADER(u).VirtualAddress + SECTIONSHEADER(u).VirtualSize), NtHeader.OptionalHeader.SectionAlignment) - 1

    If offset >= StartAddress And offset <= EndAddresss Then
        RawFileOffsetToCheck = offset - StartAddress  + SECTIONSHEADER(u).PointerToRawData
    End If
    'Hunt for strings
    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]
Next u


Public Function RoundUp(V, M) As Long
    If (V Mod M) = 0 Then
        RoundUp = V
    Else
        RoundUp = ((V \ M) + 1) * M
    End If
End Function

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved.

Dim AddressOfPE As Long
Dim RawFileOffsetToCheck As Long
Dim StartAddress as Long
Dim EndAddresss as Long   

AddressOfPE = NTHEADER.OptionalHeader.ImageBase

For u = 0 To UBound(SECTIONSHEADER)
    StartAddress = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    EndAddresss = AddressOfPE + RoundUp((SECTIONSHEADER(u).VirtualAddress + SECTIONSHEADER(u).VirtualSize), NtHeader.OptionalHeader.SectionAlignment) - 1

    If offset >= StartAddress And offset <= EndAddresss Then
        RawFileOffsetToCheck = offset - StartAddress  + SECTIONSHEADER(u).PointerToRawData
    End If
    'Hunt for strings
    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]
Next u


Public Function RoundUp(V, M) As Long
    If (V Mod M) = 0 Then
        RoundUp = V
    Else
        RoundUp = ((V \ M) + 1) * M
    End If
End Function

Debug outputs exactly like ollydbg view

.text  401000 23ACFFF
.rdata 23AD000 2C02FFF
.data  2C03000 5907FFF
.rsrc  5908000 5918FFF

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved.

Dim AddressOfPE As Long
Dim RawFileOffsetToCheck As Long

 
AddressOfPE = NTHEADER.OptionalHeader.ImageBase
 
Dim StartAddresses() As Long
Dim EndAddressess() As Long

ReDim StartAddresses(UBound(SECTIONSHEADER)) 'holds 4 atm [.text, .rdata, .data, .rsrc]
ReDim EndAddressess(UBound(SECTIONSHEADER)) 'holds 4 atm [.text, .rdata, .data, .rsrc]

'Preloop to calculate proper EndAddresses for the StartAddresses
For u = 0 To UBound(SECTIONSHEADER)
    StartAddresses(u) = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    If u > 0 Then
        'Fill in previous EndAddress from the StartAddress gathered before.
        EndAddressess(u - 1) = (StartAddresses(u) - 1)
    End If
    If u = UBound(SECTIONSHEADER) Then
        'No idea how to fill in last EndAddress so I just use VirtualSize
        EndAddressess(u) = StartAddresses(u) + SECTIONSHEADER(u).VirtualSize
    End If
Next u

For u = 0 To UBound(SECTIONSHEADER)
    If offset >= StartAddresses(u) And offset <= EndAddressess(u) Then
        RawFileOffsetToCheck = offset - StartAddresses(u) + SECTIONSHEADER(u).PointerToRawData
    End If
    'Hunt for strings
    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]
Next u

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved.

Dim AddressOfPE As Long
Dim RawFileOffsetToCheck As Long
Dim StartAddress as Long
Dim EndAddresss as Long   

AddressOfPE = NTHEADER.OptionalHeader.ImageBase

For u = 0 To UBound(SECTIONSHEADER)
    StartAddress = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    EndAddresss = RoundUp((SECTIONSHEADER(u).VirtualAddress + SECTIONSHEADER(u).VirtualSize), NtHeader.OptionalHeader.SectionAlignment) - 1

    If offset >= StartAddress And offset <= EndAddresss Then
        RawFileOffsetToCheck = offset - StartAddress  + SECTIONSHEADER(u).PointerToRawData
    End If
    'Hunt for strings
    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]
Next u


Public Function RoundUp(V, M) As Long
    If (V Mod M) = 0 Then
        RoundUp = V
    Else
        RoundUp = ((V \ M) + 1) * M
    End If
End Function

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved.

Dim AddressOfPE As Long
Dim RawFileOffsetToCheck As Long


AddressOfPE = NTHEADER.OptionalHeader.ImageBase
 
Dim StartAddresses() As Long
Dim EndAddressess() As Long

ReDim StartAddresses(UBound(SECTIONSHEADER)) 'holds 4 atm [.text, .rdata, .data, .rsrc]
ReDim EndAddressess(UBound(SECTIONSHEADER)) 'holds 4 atm [.text, .rdata, .data, .rsrc]

'Preloop to calculate proper EndAddresses for the StartAddresses
For u = 0 To UBound(SECTIONSHEADER)
    StartAddresses(u) = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    If u > 0 Then
        'Fill in previous EndAddress from the StartAddress gathered before.
        EndAddressess(u - 1) = (StartAddresses(u) - 1)
    End If
    If u = UBound(SECTIONSHEADER) Then
        'No idea how to fill in last EndAddress so I just use VirtualSize
        EndAddressess(u) = StartAddresses(u) + SECTIONSHEADER(u).VirtualSize
    End If
Next u

For u = 0 To UBound(SECTIONSHEADER)
    If offset >= StartAddresses(u) And offset <= EndAddressess(u) Then
        RawFileOffsetToCheck = offset - StartAddresses(u) + SECTIONSHEADER(u).PointerToRawData
    End If
    'Hunt for strings
    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]
Next u