CODEWITHSUNDEEP
windowsreverse-engineeringfile-formatportable-executable
user277465
user277465

Reputation:

"Relative Virtual Addresses", relative to what?

I have just been reading about the offsets of instructions which they are in a file on the disk, the RVA and the VA once they are loaded into the memory. I also read that if a PE file were loaded into the memory exactly as it were in the disk, the RVA would be same as the file offsets(and that it would be very unusual for that to happen).

My doubt is - under normal circumstances, what are these RVA's relative to? The start of that particular PE data structure?

Edit: by PE data structure I mean - PE header, DOS header, DOS stub, PE file header, Image optional header, Section table and Data directories.

Upvotes: 7

Views: 4094

Answers (1)

David Heffernan
David Heffernan

Reputation: 613013

RVA is the address relative to the image base address, after having been loaded into memory.

The MS PE/COFF specification says:

Relative virtual address. In an image file, the address of an item after it is loaded into memory, with the base address of the image file subtracted from it. The RVA of an item almost always differs from its position within the file on disk (file pointer).

Upvotes: 12

Related Questions