如何将 EXE 中的文件偏移量映射到其 PE 部分
我打开了一个用 ImageHlp.dll 编写的程序来稍微玩一下，我注意到文件中似乎有很大的间隙。据我了解，对于每个 PE 部分，部分标头将其在文件中的偏移量指定为 PhysicalAddress，其大小指定为 SizeOfRawData，因此来自 PhysicalAddress 的所有内容 到 PhysicalAddress + SizeOfRawData 应该是该部分。但是有大量的 EXE 文件没有被这些范围覆盖，所以我肯定遗漏了一些东西。
我知道我可以使用 ImageRVAToSection 并给它一个 RVA 地址来找出 RVA 位于哪个部分。有没有办法对文件偏移量执行类似的操作？我怎样才能找到哪个 PE 节字节 $ED178 或其他属于哪个？
I've opened up a program I wrote with ImageHlp.dll to play around with it a little, and I noticed that there seem to be large gaps in the file. As I understand it, for each PE section, the section header gives its offset in the file as PhysicalAddress, and its size as SizeOfRawData, and thus everything from PhysicalAddress to PhysicalAddress + SizeOfRawData ought to be that section. But there are large swaths of the EXE file that aren't covered by these ranges, so I must be missing something.
I know I can use ImageRVAToSection and give it an RVA address to find out which section that RVA is located in. Is there any way to do something similar with file offsets? How can I find out which PE section byte $ED178 or whatever belongs to?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
编辑：抱歉，我没有仔细阅读你的问题。
经过一番查找，我发现了一些像您提到的那样的文件，节标题中的数据并未涵盖文件的全部内容。到目前为止，我发现的大多数内容都包含未涵盖的调试记录。还有一些其他的差异我还没有弄清楚。当/如果我能弄清楚更多，我会添加它。
Edit: Sorry, I didn't read your question carefully enough.
Doing some looking, I'm finding a few files like you mentioned, that the data in the section headers doesn't cover the entire contents of the file. Most of those I've found so far contain a debug record that's not covered. There are a few others with discrepancies I haven't been able to figure out yet though. When/if I can figure out more, I'll add it.
我发布在 如何使用 VirtualAllocEx 是否为代码洞穴腾出空间？ 一个检查内存中当前加载的 PE 的代码片段。如果您将内存中的 DLL 内容与磁盘上的内容（显示 ImageHlp.dll）进行比较，您可能会找到问题的答案。
I posted in How does one use VirtualAllocEx do make room for a code cave? a code fragment which examine PEs current loaded in the memory. Probably you will find the answer on your question if you compare the contain of DLL in memory with the contain on the disk (which shows ImageHlp.dll).