How do you calculate Address Start / Size of PE Section like .rdata / .data

Question

I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.

I started of with trying to map the memory map's addresses exactly the same way ollydbg does it.

The PE header is at 0x00400000 with Size 0x1000

I assume the 0x00400000 is retrieved like so.

Dim AddressOfPE As Long = NTHEADER.OptionalHeader.ImageBase

Now I want to map the addresses for all the other stuff most importantly .text .rdata but I wouldn't mind having them all.

what I tried is this

For u = 0 To UBound(SECTIONSHEADER)
    AddressStart = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & _
    " AddressStart = " & Hex(AddressStart) & _
    " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & _
    " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize) & _
    " SizeOfRawData = " & Hex(SECTIONSHEADER(u).SizeOfRawData)
    'Hunt for strings
    If SECTIONSHEADER(u).nameSec = ".rdata" Or SECTIONSHEADER(u).nameSec = ".data" Then
        MsgBox "a"
    End If
    AddressEnd = AddressStart + SECTIONSHEADER(u).SizeOfRawData
    Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & _
    " AddressEnd(?) = " & Hex(AddressEnd) & _
    " OllyAddressEnd(?) = " & Hex(SECTIONSHEADER(u).SizeOfRawData)
Next u

Debug log looks like this

(0) .text  AddressStart = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD SizeOfRawData = 1FAB400
(0) .text  AddressEnd(?) = 23AC400 OllyAddressEnd(?) = 1FAB400
(1) .rdata AddressStart = 23AD000 VirtualAddress = 1FAD000 VirtualSize = 855586 SizeOfRawData = 855600
(1) .rdata AddressEnd(?) = 2C02600 OllyAddressEnd(?) = 855600
(2) .data  AddressStart = 2C03000 VirtualAddress = 2803000 VirtualSize = 2D045C4 SizeOfRawData = 1DF000
(2) .data  AddressEnd(?) = 2DE2000 OllyAddressEnd(?) = 1DF000
(3) .rsrc  AddressStart = 5908000 VirtualAddress = 5508000 VirtualSize = 105CC SizeOfRawData = 10600
(3) .rsrc  AddressEnd(?) = 5918600 OllyAddressEnd(?) = 10600

Looking at this image seems I got it all right? but the size addresses are off.

Answer 1

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved.

Dim AddressOfPE As Long
Dim RawFileOffsetToCheck As Long
Dim StartAddress as Long
Dim EndAddresss as Long   

AddressOfPE = NTHEADER.OptionalHeader.ImageBase

For u = 0 To UBound(SECTIONSHEADER)
    StartAddress = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    EndAddresss = AddressOfPE + RoundUp((SECTIONSHEADER(u).VirtualAddress + SECTIONSHEADER(u).VirtualSize), NtHeader.OptionalHeader.SectionAlignment) - 1

    If offset >= StartAddress And offset <= EndAddresss Then
        RawFileOffsetToCheck = offset - StartAddress  + SECTIONSHEADER(u).PointerToRawData
    End If
    'Hunt for strings
    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]
Next u


Public Function RoundUp(V, M) As Long
    If (V Mod M) = 0 Then
        RoundUp = V
    Else
        RoundUp = ((V \ M) + 1) * M
    End If
End Function

Debug outputs exactly like ollydbg view

.text  401000 23ACFFF
.rdata 23AD000 2C02FFF
.data  2C03000 5907FFF
.rsrc  5908000 5918FFF