1

I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.

I started of with trying to map the memory map's addresses exactly the same way ollydbg does it.

ollyview

The PE header is at 0x00400000 with Size 0x1000

I assume the 0x00400000 is retrieved like so.

Dim AddressOfPE As Long = NTHEADER.OptionalHeader.ImageBase

Now I want to map the addresses for all the other stuff most importantly .text .rdata but I wouldn't mind having them all.

what I tried is this

For u = 0 To UBound(SECTIONSHEADER)
    AddressStart = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & _
    " AddressStart = " & Hex(AddressStart) & _
    " VirtualAddress = " & Hex(SECTIONSHEADER(u).VirtualAddress) & _
    " VirtualSize = " & Hex(SECTIONSHEADER(u).VirtualSize) & _
    " SizeOfRawData = " & Hex(SECTIONSHEADER(u).SizeOfRawData)
    'Hunt for strings
    If SECTIONSHEADER(u).nameSec = ".rdata" Or SECTIONSHEADER(u).nameSec = ".data" Then
        MsgBox "a"
    End If
    AddressEnd = AddressStart + SECTIONSHEADER(u).SizeOfRawData
    Debug.Print "(" & u & ") " & SECTIONSHEADER(u).nameSec & _
    " AddressEnd(?) = " & Hex(AddressEnd) & _
    " OllyAddressEnd(?) = " & Hex(SECTIONSHEADER(u).SizeOfRawData)
Next u

Debug log looks like this

(0) .text  AddressStart = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD SizeOfRawData = 1FAB400
(0) .text  AddressEnd(?) = 23AC400 OllyAddressEnd(?) = 1FAB400
(1) .rdata AddressStart = 23AD000 VirtualAddress = 1FAD000 VirtualSize = 855586 SizeOfRawData = 855600
(1) .rdata AddressEnd(?) = 2C02600 OllyAddressEnd(?) = 855600
(2) .data  AddressStart = 2C03000 VirtualAddress = 2803000 VirtualSize = 2D045C4 SizeOfRawData = 1DF000
(2) .data  AddressEnd(?) = 2DE2000 OllyAddressEnd(?) = 1DF000
(3) .rsrc  AddressStart = 5908000 VirtualAddress = 5508000 VirtualSize = 105CC SizeOfRawData = 10600
(3) .rsrc  AddressEnd(?) = 5918600 OllyAddressEnd(?) = 10600

Looking at this image seems I got it all right? but the size addresses are off.

pe101 image

2

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved.

Dim AddressOfPE As Long
Dim RawFileOffsetToCheck As Long
Dim StartAddress as Long
Dim EndAddresss as Long   

AddressOfPE = NTHEADER.OptionalHeader.ImageBase

For u = 0 To UBound(SECTIONSHEADER)
    StartAddress = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    EndAddresss = AddressOfPE + RoundUp((SECTIONSHEADER(u).VirtualAddress + SECTIONSHEADER(u).VirtualSize), NtHeader.OptionalHeader.SectionAlignment) - 1

    If offset >= StartAddress And offset <= EndAddresss Then
        RawFileOffsetToCheck = offset - StartAddress  + SECTIONSHEADER(u).PointerToRawData
    End If
    'Hunt for strings
    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]
Next u


Public Function RoundUp(V, M) As Long
    If (V Mod M) = 0 Then
        RoundUp = V
    Else
        RoundUp = ((V \ M) + 1) * M
    End If
End Function

Debug outputs exactly like ollydbg view

.text  401000 23ACFFF
.rdata 23AD000 2C02FFF
.data  2C03000 5907FFF
.rsrc  5908000 5918FFF
  • 1
    the algorithm is essentially the smaller of VirtualSize and SizeOfRawData (except when SizeOfRawData is zero, then VirtualSize is always used), rounded up to a multiple of SectionAlignment. I can hand-craft some corner cases which break that algorithm, but a compiler isn't going to do that. – peter ferrie Jan 14 '16 at 19:51
  • if VirtualSize = 0x1700 and SectionAlignment = 0x200 then EndAddress = EndAddress + (0x1700 % 0x200); correct? – SSpoke Jan 15 '16 at 0:12
  • Doesn't give me good results I will try to fix this up.. I think I know a better way – SSpoke Jan 15 '16 at 1:07
  • Nope that doesn't do it adding the SectionAlignment makes it go over into the next section, so that's not it either, I know of some tricks I discovered like Export tables size is calculated like this (NTHEADER.OptionalHeader.DataDirectory(1).Size / 20) - 1 1 being Exports index. I been looking at other debuggers source code and FileAlignment and SectionAlignment isn't even used in them very odd indeed. – SSpoke Jan 15 '16 at 1:14
  • Okay thanks for your advice it works perfectly!, I didn't understand the concept of rounding up it works good now. – SSpoke Jan 15 '16 at 1:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.