How to find "RawAddress" of a "VirtualAddress"?

Question

I'm trying to parse a PE file manually as below:

    1 ### DOS Header
    2 
    3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............
    4 00000010: b800 0000 0000 0000 4000 0000 0000 0000  ........@.......
    5 00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    6 00000030: 0000 0000 0000 0000 0000 0000 8000 0000  ................   // e_lfanew = 0x00000080
    7 
    8     - DOS Stub
    9 00000040: 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468  ........!..L.!Th
   10 00000050: 6973 2070 726f 6772 616d 2063 616e 6e6f  is program canno
   11 00000060: 7420 6265 2072 756e 2069 6e20 444f 5320  t be run in DOS
   12 00000070: 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000  mode....$.......
   13 
   14 -------------------------------------------------------------------
   15 
   16 ### NT Header
   17 
   18     - Magic
   19 00000080: 5045 0000
   20 
   21     - File Header
   22                     4c01 0f00 3f55 785e 0088 0400  PE..L...?Ux^....   // NumberOfSections = 0x000f = 15
   23 00000090: a705 0000 e000 0701                                         // SizeOfOptionalHeader = 0x000e = 14 * 16
   24 
   25     - Optional Header
   26                               0b01 0221 0022 0000  ...........!."..
   27 000000a0: 003a 0000 0006 0000 c014 0000 0010 0000  .:..............   // EntryPoint = 0x000014c0 & BaseOfCode = 0x00001000
   28 000000b0: 0040 0000 0000 4000 0010 0000 0002 0000  .@....@.........   // BaseOfData = 0x00004000 & ImageBase = 0x00400000 & SectionAlignment = 0x00001000 & FileAlignment = 0x00000200
   29 000000c0: 0400 0000 0100 0000 0400 0000 0000 0000  ................
   30 000000d0: 0030 0500 0004 0000 3004 0500 0300 4001  .0......0.....@.
   31 000000e0: 0000 2000 0010 0000 0000 1000 0010 0000  .. .............
   32 000000f0: 0000 0000 1000 0000
   33 
   34         - Data Directories
   35                               0000 0000 0000 0000  ................
   36 00000100: 0070 0000 5c07 0000 0000 0000 0000 0000  .p..\...........   // ImportDirectory: VirtualAddress = 0x00007000 & Size = 0x0000075c
   37 00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
   38 00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
   39 00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
   40 00000140: 5052 0000 1800 0000 0000 0000 0000 0000  PR..............
   41 00000150: 0000 0000 0000 0000 6871 0000 0401 0000  ........hq......
   42 00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
   43 00000170: 0000 0000 0000 0000
   44 
   45 -------------------------------------------------
   46 
   47 ### Section Headers
   48 
   49                               2e74 6578 7400 0000  .........text...
   50 00000180: 6421 0000 0010 0000 0022 0000 0004 0000  d!......."......
   51 00000190: 0000 0000 0000 0000 0000 0000 6000 5060  ............`.P`
   52 
   53 000001a0: 2e64 6174 6100 0000 3400 0000 0040 0000  .data...4....@..
   54 000001b0: 0002 0000 0026 0000 0000 0000 0000 0000  .....&..........
   55 000001c0: 0000 0000 4000 30c0
   56                               2e72 6461 7461 0000  [email protected]..
   57 000001d0: 6c08 0000 0050 0000 000a 0000 0028 0000  l....P.......(..
   58 000001e0: 0000 0000 0000 0000 0000 0000 4000 3040  [email protected]@
   59 
   60 000001f0: 2e62 7373 0000 0000 0c04 0000 0060 0000  .bss.........`..
   61 00000200: 0000 0000 0000 0000 0000 0000 0000 0000  ................
   62 00000210: 0000 0000 8000 60c0
   63                               2e69 6461 7461 0000  ......`..idata..   // .idata section header
   64 00000220: 5c07 0000 0070 0000 0008 0000 0032 0000  \....p.......2..   // VirtualSize = 0x0000075c & VirtualAddress = 0x00000700
   65 00000230: 0000 0000 0000 0000 0000 0000 4000 30c0  [email protected].
   66 
   67 00000240: 2e43 5254 0000 0000 3400 0000 0080 0000  .CRT....4.......
   68 00000250: 0002 0000 003a 0000 0000 0000 0000 0000  .....:..........
   69 00000260: 0000 0000 4000 30c0
   70                               2e74 6c73 0000 0000  [email protected]....
   71 00000270: 0800 0000 0090 0000 0002 0000 003c 0000  .............<..
   72 00000280: 0000 0000 0000 0000 0000 0000 4000 30c0  [email protected].
   73 
   74 00000290: 2f34 0000 0000 0000 e002 0000 00a0 0000  /4..............
   75 000002a0: 0004 0000 003e 0000 0000 0000 0000 0000  .....>..........
   76 000002b0: 0000 0000 4000 1042
   77                               2f31 3900 0000 0000  [email protected]/19.....
   78 000002c0: efb8 0300 00b0 0000 00ba 0300 0042 0000  .............B..
   79 000002d0: 0000 0000 0000 0000 0000 0000 4000 1042  [email protected]
   80 
   81 000002e0: 2f33 3100 0000 0000 dd25 0000 0070 0400  /31......%...p..
   82 000002f0: 0026 0000 00fc 0300 0000 0000 0000 0000  .&..............
   83 00000300: 0000 0000 4000 1042
   84                               2f34 3500 0000 0000  [email protected]/45.....
   85 00000310: 9d34 0000 00a0 0400 0036 0000 0022 0400  .4.......6..."..
   86 00000320: 0000 0000 0000 0000 0000 0000 4000 1042  [email protected]
   87 
   88 00000330: 2f35 3700 0000 0000 1c09 0000 00e0 0400  /57.............
   89 00000340: 000a 0000 0058 0400 0000 0000 0000 0000  .....X..........
   90 00000350: 0000 0000 4000 3042
   91 
   92                               2f37 3000 0000 0000  [email protected]/70.....
   93 00000360: 1e05 0000 00f0 0400 0006 0000 0062 0400  .............b..
   94 00000370: 0000 0000 0000 0000 0000 0000 4000 1042  [email protected]
   95 
   96 00000380: 2f38 3100 0000 0000 601a 0000 0000 0500  /81.....`.......
   97 00000390: 001c 0000 0068 0400 0000 0000 0000 0000  .....h..........
   98 000003a0: 0000 0000 4000 1042
   99 
  100                               2f39 3200 0000 0000  [email protected]/92.....
  101 000003b0: 4003 0000 0020 0500 0004 0000 0084 0400  @.... ..........
  102 000003c0: 0000 0000 0000 0000 0000 0000 4000 1042  [email protected]
  103 
  104 -------------------------------------------------
  105 
  106     - Padding for FileAlignment?
  107 
  108 000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
  109 000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
  110 000003f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
  111 
  112 ------------------------------------------------
  113 
  114 ### Sections
  115 
  116 00000400: c38d b426 0000 0000 8db4 2600 0000 0090  ...&......&.....
  117 00000410: 83ec 1c31 c066 813d 0000 4000 4d5a c705  [email protected]..
  118 00000420: 8c63 4000 0100 0000 c705 8863 4000 0100  [email protected]@...
  119 00000430: 0000 c705 8463 4000 0100 0000 c705 3060  [email protected]`
  120 00000440: 4000 0100 0000 7518 8b15 3c00 4000 81ba  @.....u...<.@...
  121 00000450: 0000 4000 5045 0000 8d8a 0000 4000 7450  [email protected][email protected]
  122 00000460: a30c 6040 00a1 9463 4000 85c0 7532 c704  ..`@[email protected]..
  123 00000470: 2401 0000 00e8 0220 0000 e805 2000 008b  $...... .... ...
  124 00000480: 15a8 6340 0089 10e8 d40f 0000 833d 1c40  ..c@.........=.@
  125 00000490: 4000 0174 4b31 c083 c41c c38d 7426 0090  @..tK1......t&..
  126 000004a0: c704 2402 0000 00e8 d01f 0000 ebcc 6690  ..$...........f.
  127 000004b0: 0fb7 5118 6681 fa0b 0174 3d66 81fa 0b02  ..Q.f....t=f....
         ...           .... Truncated .....                   ...

My questions:

1. As you see above, in the line #36, we have virtualAddress related to import libraries. How can I find the corresponding rawAddress of those data in the file content? I mean, how can I convert virtualAddresses to rawAddresses?
2. As you see above, we have virtualAddress and Size fields in second index of DataDirectory in optionalHeader (Line #36) and also in .idata sectionHeader (Line #64). And both have equal values. Why? Isn't that redundant? Do we have some cases which these fields have different values?
3. As far as I know, .text section contains the program's assembly code. So why EntryPoint field in the OptionalHeader doesn't have the address of beginning of .text section?

Answer 1

1. you need to parse the section table, figure out to which section your address belongs (using their VirtualAddress and VirtualSize), then calculate the offset from the section start and add it to the section's physical offset. E.g.:

   SectionOffset = addr - section[i].VirtualAddress
offset = SectionOffset + section[i].PointerToRawData

2. A directory does not necessarily match a whole section. It may be a small part of a section or (in theory) even cross a section boundary. Note that in practice the OS loader may ignore the size field but use e.g. a NULL terminator to detect the end of data.

3. entry point is not necessarily at the start of .text. This was common in a.out binaries but is pretty rare nowadays both for PE and ELF. Usually there are other functions (e.g. library code) and/or read-only data at the beginning.