PE Offset to RVA
Author: utkonosCreated Oct 26, 2019Updated Jun 1, 2025
It would be quite useful to have the reverse function in the PE module pe.offset_to_rva(). Here is a use case:
This condition:
for any i in (1..#op1) : ((@a + pe.sections[pe.section_index(@a)].virtual_address - pe.sections[pe.section_index(@a)].raw_data_offset) - (@op1[i] + pe.sections[pe.section_index(@op1[i])].virtual_address - pe.sections[pe.section_index(@op1[i])].raw_data_offset) - 8 == uint32(@op1[i] + 4))Would be written like so:
for any i in (1..#op1) : (pe.offset_to_rva(@a) - pe.offset_to_rva(@op1[i]) - 8 == uint32(@op1[i] + 4))Source: VirusTotal/yara