I've spent hours trying to understand how windows PE resource structure works. and I cannot figure this out, I think this should be easy for people who have worked with pe resource table. I found this code snippet
void RelocateRSRC(PBYTE prsrc, PIMAGE_RESOURCE_DIRECTORY pird, LONG Delta)
{
if (DWORD NumberOfEntries = pird->NumberOfNamedEntries + pird->NumberOfIdEntries)
{
PIMAGE_RESOURCE_DIRECTORY_ENTRY pirde = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pird + 1);
do
{
if (pirde->DataIsDirectory)
{
RelocateRSRC(prsrc,
(PIMAGE_RESOURCE_DIRECTORY)(prsrc + pirde->OffsetToDirectory),
Delta);
}
else
{
PIMAGE_RESOURCE_DATA_ENTRY data =
(PIMAGE_RESOURCE_DATA_ENTRY)(prsrc + pirde->OffsetToData);
data->OffsetToData += Delta;
}
} while (pirde++, --NumberOfEntries);
}
}
for an executable to be able to load it's resource after it's relocated, the resource table needs to be modified. but I cannot figure out what the Delta (third parameter) is, at first I thought that it is the difference between base address of the mapped executable and the base address DWORD delta = (DWORD)image - nt->OptionalHeader.ImageBase; but it doesn't work.
I have read the pe resource structure and cannot figure out what the post author meant by DWORD Diff = newRVA - oldRVA; // calc once OffsetToData += Diff;
what is newRVA and oldRVA is referring to? How do I get those values?