What is really correct translation algorithm to get an offset in portable executable file from relative virtual address of some byte in the image?
I see next cases:
- RVA points into the header part of image
- RVA points into a section part presented in file
- RVA points into a section part not presented in file (some loadtime initialized data)
- RVA points out of image
For the first case it's like RVA is equal to offset in a file. (If all parts of file are mapped to the image. I'm not sure about DOS header.)
Further, mapped section can be biger than section in a file so some RVAs jast have no offset like RVA that points out of image.
And last things that I does not undestand at all. Are the values of fildes SizeOfImage, VirtualSize, VirtualAddress, PointerToRawData, SizeOfRawData already take into consideration file alignment and section alignment?
I saw some realizations of RvaToRaw full of black magic that made a correction for alignments, but without any explanation.
If no more alignment is needed so for case 2 it's
raw = rva - rvaOfSection + SectionRaw