WCU / Cybersecurity
HomeCSC 471CSC 472Search /
~/CSC 471/Class 04/KP 07
Class 04 · KP 07 / 20

Converting RVA to File Offset

on disk (file offset)PointerToRawDataraw bytesin memory (RVA)VirtualAddressmapped bytesfileOffset = RVA − VirtualAddress + PointerToRawData
RVA-to-offset: the section table maps a memory address back to the file.

Use the section table. Each section header gives:

  • VirtualAddress: the section's RVA in memory.
  • VirtualSize: its size in memory.
  • PointerToRawData: the section's file offset on disk.
  • SizeOfRawData: its size on disk.

Algorithm to convert an RVA:

  • Find the section where VirtualAddress ≤ RVA < VirtualAddress + VirtualSize.
  • Compute: fileOffset = RVA - VirtualAddress + PointerToRawData
Key Takeaway

RVA to offset = subtract the section's VirtualAddress, add its PointerToRawData.

PreviousRVA vs File OffsetNextWorked Example: RVA to File Offset