RVA vs File Offset

Two different address spaces describe the same file:

• File offset (a.k.a. raw / physical offset): position of a byte on disk, from the start of the file.
• RVA (Relative Virtual Address): offset from ImageBase once the file is loaded into memory.
• VA (Virtual Address) = ImageBase + RVA.

They differ because SectionAlignment (memory) and

FileAlignment (disk) are usually different, so sections sit at

different positions on disk vs in memory.

Why analysts convert constantly

A directory entry gives you an RVA, but to read that data from the

file on disk you need the corresponding file offset.