CODEWITHSUNDEEP
windowsdllloaderportable-executable
Spleo
Spleo

Reputation: 1

RVA of exported function is different after load

I opened crypt32.dll and looked at its export table using CFF explorer. CFF Explorer

I then manually loaded the dll using LoadLibrary and noticed inconsistency between the functionRVA in CFF explorer and the actual RVA (calculated using windbg).

For example CFF explorer shows that that the RVA of CertUnregisterPhysicalStore is 90640 Where windbg says the RVA is 90030 (calculation was crypt32!CertUnregisterPhysicalStore - crypt32)

windbg

Why are the RVAs not the same?

Upvotes: 0

Views: 59

Answers (0)

Related Questions