diff --git a/BurnOutSharp.Builder/Extensions.cs b/BurnOutSharp.Builder/Extensions.cs
index 5c0dd6a0..97fd823c 100644
--- a/BurnOutSharp.Builder/Extensions.cs
+++ b/BurnOutSharp.Builder/Extensions.cs
@@ -329,5 +329,37 @@ namespace BurnOutSharp.Builder
}
#endregion
+
+ #region Portable Executable
+
+ ///
+ /// Convert a virtual address to a physical one
+ ///
+ /// Virtual address to convert
+ /// Array of sections to check against
+ /// Physical address, 0 on error
+ public static uint ConvertVirtualAddress(this uint virtualAddress, Models.PortableExecutable.SectionHeader[] sections)
+ {
+ // Loop through all of the sections
+ for (int i = 0; i < sections.Length; i++)
+ {
+ // If the section is invalid, just skip it
+ if (sections[i] == null)
+ continue;
+
+ // If the section "starts" at 0, just skip it
+ if (sections[i].PointerToRawData == 0)
+ continue;
+
+ // Attempt to derive the physical address from the current section
+ var section = sections[i];
+ if (virtualAddress >= section.VirtualAddress && virtualAddress <= section.VirtualAddress + section.VirtualSize)
+ return section.PointerToRawData + virtualAddress - section.VirtualAddress;
+ }
+
+ return 0;
+ }
+
+ #endregion
}
}
\ No newline at end of file
diff --git a/BurnOutSharp.Builder/PortableExecutable.cs b/BurnOutSharp.Builder/PortableExecutable.cs
index 3fe7f7f7..cabadba5 100644
--- a/BurnOutSharp.Builder/PortableExecutable.cs
+++ b/BurnOutSharp.Builder/PortableExecutable.cs
@@ -94,13 +94,12 @@ namespace BurnOutSharp.Builder
#region COFF Symbol Table
- // TODO: Validate that this is correct
+ // TODO: Validate that this is correct with an "old" PE
if (coffFileHeader.PointerToSymbolTable != 0)
{
// If the offset for the COFF symbol table doesn't exist
int tableAddress = initialOffset
- + (int)stub.Header.NewExeHeaderAddr
- + (int)coffFileHeader.PointerToSymbolTable;
+ + (int)coffFileHeader.PointerToSymbolTable.ConvertVirtualAddress(executable.SectionTable);
if (tableAddress >= data.Length)
return executable;
@@ -596,13 +595,12 @@ namespace BurnOutSharp.Builder
#region COFF Symbol Table
- // TODO: Validate that this is correct
+ // TODO: Validate that this is correct with an "old" PE
if (coffFileHeader.PointerToSymbolTable != 0)
{
// If the offset for the COFF symbol table doesn't exist
int tableAddress = initialOffset
- + (int)stub.Header.NewExeHeaderAddr
- + (int)coffFileHeader.PointerToSymbolTable;
+ + (int)coffFileHeader.PointerToSymbolTable.ConvertVirtualAddress(executable.SectionTable);
if (tableAddress >= data.Length)
return executable;