CODEWITHSUNDEEP
exeportable-executable
user1232138
user1232138

Reputation: 5541

Difference between offset and RVA

What is the difference between a relative virtual address and an offset from the base of a file??

Upvotes: 4

Views: 5318

Answers (1)

dsign
dsign

Reputation: 12700

The RVA is the relative-virtual address, that is, the distance from the preferred base address. The preferred base address is stated in the PE header, and is the (preferred) virtual address of the start of the image in memory for when the executable be loaded in memory.

And the file offset is the number of bytes you have to read from the beginning of the PE file to arrive somewhere in the file. So, if you have a section, you will find both things in the section header: the RVA of the section and its offset in the file; you will also find two sizes, one for how much virtual memory the section will get once loaded and one that merely indicates the size of the section data in the PE file.

Many references inside a PE are given as RVAs. In such cases, you need to check in all the section headers (or have some sort of map) to get the offset in the PE file of the reference.

Upvotes: 6

Related Questions