I need to get the RVA of a specific function in a dll and then add that RVA to the base loading address of the dll to find the function in the remote processes memory. However I need to pass this memory address in a buffer to a thread that will be created in the remote process. So I was wondering whether or not I should pass this as a DWORD representation of the address. I'm on 64 bit Windows, so if so should it be DWORD_PTR, DWORD64, etc? Or can I still just pass it as a pointer which wouldn't really make sense to me.
1 Answers
1
votes
Lets do brief investigation. We will refer to spec. Look at SizeOfImage field in optional header:
Size, in bytes, of image, including all headers; must be a multiple of Section Alignment.
Actually this is the size of mapped image and it is 4-byte integer both for PE32 and PE32+ formats. As consequence all relative addresses inside PE are always fit into 32-bit integer. Also the most of RVA fields in PE structures are declared as DWORD, that IMO is a good hint.
To top it off: you can store RVA in DWORD both on 32-bit or 64-bit system.
