Search code examples
portable-executable

Correct offset of specific section PE


I want to know if my calculations are correct. I know the following:

AddressOfEntryPoint(of PE)
ImageBase(Of PE)
VirtualAddress of section i want

so the offset (in file) of this section is offset = ImageBase - VirtualAddress

Is this correct? If not ,please explain how I calculate offset of the section.


Solution

  • You can use pefile module.here

    for section in pe.sections:
      print section.PointerToRawData