IMO,this should hold:
rva = raw - imagebase
which is not the case in the graph,why?
IMO,this should hold: rva = raw – imagebase which is not the case in
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
IMO,this should hold:
rva = raw - imagebase
which is not the case in the graph,why?
The entry point RVA, entry point raw address, and image base address are not related in that way.
The image base is the “preferred address of the first byte of the image when it is loaded in memory”. In other words, it’s the virtual address of the image when it gets loaded assuming there’s not a conflict. If there is an address conflict when the image is loaded (e.g. another image is already loaded in an overlapping range), then a new base address will be chosen for the image.
An RVA is a relative virtual address. It is “relative” in the sense that it is changed when the image is actually loaded. It’s the address when the base address is not known (e.g. when the image isn’t loaded). Once the image is loaded, the RVA becomes a virtual address (VA), an actual address in virtual memory.
The raw vs. RVA distinction is due to alignment. There is section alignment (the alignment of the sections when they get loaded into memory) as well as file alignment (the alignment of the raw data in the sections). The section alignment here is 0x1000 while the file alignment is 0x200.
The entry point RVA is used to determine the VA of the entry point when the image is loaded (i.e. the entry point will be located at virtual address
EntryPoint (rva) + ImageBase). The entry point raw address is the offset into the file where the entry point is located.This document has a good explanation of alignment.