typedef struct _STUB_CONFIGURATION {
DWORD NewEntryRVA;
DWORD OrgEntryRVA;
DWORD ImageBase;
DWORD PrefImageBase;
DWORD OrgITRVA;
DWORD RelocRVA;
DWORD MSLRVA;
DWORD ExtraDataRVA;
DWORD RedirTableRVA;
DWORD Flags;
} STUB_CONFIGURATION;
Members
- NewEntryRVA
- This is a relative virtual address of new entrypoint of executable. Used internally.
- OrgEntryRVA
- Original entrypoint RVA. This member is zero unless INJECT_FLAG_JUMPTOOEP flag specified.
- ImageBase
- Current Image Base of host executable.
- PrefImageBase
- Preferred image base of host executable.
- OrgITRVA
- Relative virtual address of original import table.
- RelocRVA
- Relative virtual address of relocations.
- MSLRVA
- Relative virtual address of linked MSL file.
- ExtraDataRVA
- Relative virtual address of embedded extra user data.
- RedirTableRVA
- Reserved field.
- Flags
- Contains the Flags as passed to the InjectFile function.
Remarks
If you don't know what does a Relative Virtual Address mean, I won't explain it here. The only thing that you need to know now is
the fact that if you want to convert a RVA to a Virtual Address you have to add the ImageBase value to it. This will create you a valid
pointer to a memory location which you need to access the desired data.