关于前天晚上三叶草例会上我讲的PE文件格式的一些相关代码

这个函数是虚拟地址转到文件偏移的函数：

DWORD VA2FOffset(LPVOID MapFileBase,DWORD Va)
{
 IMAGE_FILE_HEADER* pehdr = (IMAGE_FILE_HEADER*)((BYTE*)MapFileBase + ((PIMAGE_DOS_HEADER)MapFileBase)->e_lfanew + 4);
 int NumOfSec = pehdr->NumberOfSections;
 LPVOID ppe = (BYTE*)MapFileBase + ((PIMAGE_DOS_HEADER)MapFileBase)->e_lfanew + sizeof(IMAGE_FILE_HEADER)+ 4 + sizeof(IMAGE_OPTIONAL_HEADER);
 IMAGE_SECTION_HEADER *ish;
 int offsetsec=-1;
 for(int i=0;i {
  ish = (IMAGE_SECTION_HEADER*)((BYTE*)ppe + 40*i);
  if(VaVirtualAddress)
  { 
   offsetsec = i-1;
   break;
  }
 }
 if (offsetsec==-1)
 {
  return 0;
 }
 ish = (IMAGE_SECTION_HEADER*)((BYTE*)ppe + 40*offsetsec);
 return Va - ish->VirtualAddress + ish->PointerToRawData;
}