VB Decompiler

MrUnleaded

Ok...i am having some problems.....very very basic...[but beyond me]

Well when i get out a Location of the Resource Directory it says the offset is 0x3000 but the real offset of the resource directory is 0x2000[i think]

what do i need to do to get the Offset 0x2000 form the RVA 0x3000??

i guess i should be able to parse this section before commonApp1 is truely done....well....ill work on it if someone can give me a hand here
_________________
-MrU

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

The offset in memory of the resource directory is the RVA 0x3000. In the file, it is located at 0x2000 because the section before is the .data section that contains no data :p It is of size 0x1000 (well 0xA54, but I digress), but since there isnt any data there isnt a point in putting it in the file. Hence, it *should* be 0x3000 in the file but the compiler, or linker rather was being a little clever.

VB doesnt use the .data section, so we can always assume it has null length. Here, I cheated a little and thought that I can just use the BaseOfData address in the "optional header" to get out the location of the resource directory. It is somewhat cheating, and it'd not work but its either that or do a couple of calculations and get the section headers and stuff, which I couldnt be bothered to do... Sarge, how about you? Should I change my ways?!