PE-inject 1.0


STUB_CONFIGURATION structure

typedef struct _STUB_CONFIGURATION {
    DWORD NewEntryRVA;
    DWORD OrgEntryRVA;
    DWORD ImageBase;
    DWORD PrefImageBase;
    DWORD OrgITRVA;
    DWORD RelocRVA;
    DWORD MSLRVA;
    DWORD ExtraDataRVA;
    DWORD RedirTableRVA;
    DWORD Flags;
} STUB_CONFIGURATION;

Members
NewEntryRVA
This is a relative virtual address of new entrypoint of executable. Used internally.
OrgEntryRVA
Original entrypoint RVA. This member is zero unless INJECT_FLAG_JUMPTOOEP flag specified.
ImageBase
Current Image Base of host executable.
PrefImageBase
Preferred image base of host executable.
OrgITRVA
Relative virtual address of original import table.
RelocRVA
Relative virtual address of relocations.
MSLRVA
Relative virtual address of linked MSL file.
ExtraDataRVA
Relative virtual address of embedded extra user data.
RedirTableRVA
Reserved field.
Flags
Contains the Flags as passed to the InjectFile function.
Remarks
If you don't know what does a Relative Virtual Address mean, I won't explain it here. The only thing that you need to know now is the fact that if you want to convert a RVA to a Virtual Address you have to add the ImageBase value to it. This will create you a valid pointer to a memory location which you need to access the desired data.