about convert.dll version 1.1

written by alpine
www.ImmortalDescendants.org


convert.dll 1.1  consits of 5 exported functions:


ReadPe
Rvatova
Returnmemp
Cleanup
Getsectioninfo

1.) ReadPe

ReadPe reads out the pe-header of the given file and does some analysis.
Before you can call Rvatova you must call ReadPe!

Parameters:

	ReadPe
	DWORD filehandle

filehandle:

Is the handle given back by a call to CreateFileA


Return values:

If the function suceeds the return value is 1 else it's 0FFFFFFFFh.
There can be some reasons why the function could fail:

there was no filehandle given
The specified file is not in Pe-format


2.)Rvatova

Rvatova converts the given Rva into the raw file offset.You have to call ReadPe
before you can use Rvatova

Parameters:

	Rvatova
	DWORD Rva
	DWORD flag

Rva:
A DWORD specifiying the RVA to convert

:flag
Can be either set to 00000000 or 00000001.
00000000 means you use Rva with ImageBase:

assuming 00400000 is the ImageBase
you would use the flag set to 00000000 and
you would push 00403000 for example

else if you use 00000001 for the flag parameter you have already substracted the 
ImageBase form Rva


Return values:

If the function suceeds it puts the raw file offset into eax else if it fails to convert
eax will be set to 0ffffffffh.
This may have the following reason:

The given Rva value was lower than the rva-value of the section


3.) Returnmemp

Returnmemp gives back a memory pointer,pointing to the beginning of the memory area 
where the Pe-header of the specified file (used in ReadPe) was read to
This is useful if you have to use the Pe-header and don't want to read it out.

Parameters:

	No Parameters needed
	

Return values:
If the function suceeds eax is the pointer to the beginning of memory area.If eax is 0
you may not have done a call to ReadPe  first.
Keep in mind that calling CleanUp will destroy that memory area.So you have to call ReadPe
again before you can use that function


4.) Cleanup

Cleanup overwrites the memory area,the pe-header is stored to with 00 and so there is
no need to allocate a new memory area if the filehandle isn't active anymore and you wanna
use a new one

Parameters

	No Parameters needed


Return values:
No return values


5.) Getsectioninfo

Getsectioninfo returns a pointer to a structure, which contains the whole section table 
info. Like Name,Rva,Rvasize,Raw offset,Raw size, section characteristics

Getsectioninfo struc:
	DWORD pointer to Name table array
	DWORD pointer to Rva size table array			
	DWORD pointer to Rva table array
	DWORD pointer to Raw size table array
	DWORD pointer to Raw offset table array
	DWORD pointer to section characteristics table arry
Getsectioninfo ends

Name table array:

	8 bytes for each section name of the section table 

Rva size table array:

	DWORD for each section, holding the Rva size

Rva table array:

	DWORD for each section , holding the RVA 

Raw size table array:

	DWORD for each section, holding the raw size

Raw offset table array:

	DWORD for each section, containing the raw offset 

Section characteristics array:

	DWORD for each section, holding the section characteristics


Return values:
If the functions suceeds it returns a pointer to the Getsectioninfo structure in eax.




I've included a .lib file and .inc file to the archive.The lib file is compatible with
TASM;Implib was used to create it
Syntax:
implib convert.lib convert.dll

The .dll works fine on win9x systems.I dunno about win2k and winnt.You may have to 
recompile it


on questions mail to

alpine@gmx.at