Return to Revisions

Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.

Still got a little bug where VirtualSize is smaller then OllyDbg's Memory Map Sizes for that section, but it seems SizeOfRawData is more accurate sometimes?

But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.

I guess I could mark this solved.

Dim AddressOfPE As Long
Dim RawFileOffsetToCheck As Long
Dim StartAddress as Long
Dim EndAddresss as Long   

AddressOfPE = NTHEADER.OptionalHeader.ImageBase

For u = 0 To UBound(SECTIONSHEADER)
    StartAddress = AddressOfPE + SECTIONSHEADER(u).VirtualAddress
    EndAddresss = RoundUp((SECTIONSHEADER(u).VirtualAddress + SECTIONSHEADER(u).VirtualSize), NtHeader.OptionalHeader.SectionAlignment) - 1

    If offset >= StartAddress And offset <= EndAddresss Then
        RawFileOffsetToCheck = offset - StartAddress  + SECTIONSHEADER(u).PointerToRawData
    End If
    'Hunt for strings
    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]
Next u


Public Function RoundUp(V, M) As Long
    If (V Mod M) = 0 Then
        RoundUp = V
    Else
        RoundUp = ((V \ M) + 1) * M
    End If
End Function