RVA2Offset，Offset2RVA

了解一点PE文件的同学因该都知道的，不解释啦：

ULONG RVA2Offset(PIMAGE_NT_HEADERS pNtHeader, ULONG ulRVA)
{
    PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((ULONG)pNtHeader + sizeof(IMAGE_NT_HEADERS));
    ULONG i = 0;

    for( i = 0; i < pNtHeader->FileHeader.NumberOfSections; i++)
    {
        if(ulRVA >= pSection[i].VirtualAddress && ulRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
        {
            return pSection[i].PointerToRawData + (ulRVA - pSection[i].VirtualAddress);
        }
    }

    return 0;
}

ULONG Offset2RVA( PIMAGE_NT_HEADERS pNtHeader, ULONG ulOffset )
{
    PIMAGE_SECTION_HEADER pSection = (PIMAGE_NT_HEADERS)( (ULONG)pNtHeader + sizeof(IMAGE_NT_HEADERS) );
    ULONG i = 0;

    for ( i = 0; i < pNtHeader->FileHeader.NumberOfSections; i++ )
    {
        if ( ulOffset >= pSection[i].PointerToRawData && ulOffset < pSection[i].PointerToRawData + pSection[i].Misc.VirtualSize )
        {
            return pSection[i].VirtualAddress + ( ulOffset - pSection[i].PointerToRawData );
        }
    }

    return 0;
}