+---------+---------+---------+---------+---------+---------+
| Segment name virtual address virtual size Physical Address physical size Flag |
+---------+---------+---------+---------+---------+---------+
| Name VOffset vsize roffset rsize Flags |
+---------+---------+---------+---------+---------+---------+
|. Text 00001000 00000092 00000400 00000200 60000020|
|. rdata 00002000 000000F6 00000600 00000200 40000040|
|. Data 00003000 0000018E 00000800 00000200 c0000040|
|. rsrc 00004000 000003a0 00000a00 00000400 c0000040|
+---------+---------+---------+---------+---------+---------+
The virtual offset address and the file physical offset address are calculated as follows:
>>>>>>>vatofileoffset (virtual address goto file offset address)
such as VA = 00401000 (virtual address)
ImageBase = 00400000 (base address)
VRk = Voffset-roffset = 00001000-00000400 (the VRk value between the file virtual address and the file's physical site)
Fileoffset = Va-imagebase-vrk = 00401000-00400000-VRK = 400 (offset address of the physical address of the file)
If VA = 00401325, then:
Fileoffset = Va-imagebase-vrk = 00401325-00400000-vrk = 725
>>>>>>fileoffsettova (file offset address to virtual address)
such as Fileoffset = 435 (file offset address)
VA = fileoffset + ImageBase + VRk = 435 + 00400000 + VRk = 00401035 (virtual address)
RPM: PE RVA to raw virtual offset address and file physical offset address