Sign in to follow this  
Followers 0
Danyfirex

Get file offset by PE Format data?

2 posts in this topic

hi mate. today I'm working with PE format and DllStructCreate, I wonder, how cant I get the offset of start section.

my IMAGE_SECTION_HEADER struncture

Local $IMAGE_SECTION_HEADER = DllStructCreate( _
"CHAR name[8];DWORD virtualsize;DWORD virtualaddress;DWORD sizeofrawdata;DWORD pointertorawdata;DWORD pointertorelocations;"& _
"DWORD pointertolinenumbers;WORD numberofrelocations;WORD numberoflinenumbers;DWORD characteristics",$datos)

Example

I get the seccion name: $1=(DllStructGetData($IMAGE_SECTION_HEADER, "Name")) how could I get the offset posicion of the section.

Sorry for my bad english.

Share this post


Link to post
Share on other sites



#2 ·  Posted (edited)

it's Solved

I make this

;e_lfanew+IMAGE_NT_HEADERS+IMAGE_DOS_HEADER+IMAGE_FILE_HEADER+section


;also


;MAGE_NT_HEADERS+valor e_lfanew

.

Edited by Danyfirex

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0