I didn't understand the reason for this 'if'. I think it will match with PE files having only one section in which the field VirtualAddress is greater than rva. In this case, is it rva pointing to some header? Wouldn't be better return the difference between rva and imagebase?
Hello guys,
I didn't understand the reason for this 'if'. I think it will match with PE files having only one section in which the field VirtualAddress is greater than rva. In this case, is it rva pointing to some header? Wouldn't be better return the difference between rva and imagebase?
Cheers!