I want to know if my calculations are correct. I know the following:
AddressOfEntryPoint(of PE)
ImageBase(Of PE)
VirtualAddress of section i want
so the offset (in file) of this section is offset = ImageBase - VirtualAddress
Is this correct? If not ,please explain how I calculate offset of the section.
You can use pefile
module.here
for section in pe.sections:
print section.PointerToRawData