shellext / Offset Calculator

Offset Calculator

Offset Calculator (frmOffsets) translates between virtual address, RVA, and file offset for a loaded PE, displays the section table, peeks at the bytes at the calculated offset, and runs DumpFix on memory-dumped images. Reachable from File Hash → right-click → Offset Calculator (32/64bit).

The dialog is initialized with a CPEEditor instance that already has the file loaded. The window caption is set to the file's ImageBase. The Entry Point label is filled in, the RVA field is pre-populated with the EP, and the calculation runs once on load — so you arrive at the dialog already looking at the bytes at the EP.

Offset Calculator dialog — Section table at top with name, virtual address, virtual size, raw offset, raw size, and characteristics. Three radio buttons choose which field is the input (the other two are computed); the bottom-right shows the section the address resolves into and a 6-byte hex peek at the calculated file offset.

Section table

The top listview shows every PE section. Columns:

Column	Description
Name	Section name (.text, .data, etc).
Virtual Addr	VirtualAddress field, hex (this is an RVA, not a fully-resolved VA).
Virtual Size	VirtualSize field, hex.
RawOffset	PointerToRawData, hex.
RawSize	SizeOfRawData, hex.
Attributes	Characteristics flags, hex.

Right-click on the section table:

Item	Action
Copy Row	Copy just the selected row, tab-delimited, with the column headers shortened (VA / VSz / ROff / RSz / Attr) for clipboard-friendly width.
Copy Table	Same as Copy Row but for every row.

The calculator

Three radio buttons on the left choose which field is the source of truth:

Mode	Inputs → Outputs
VirtAddress	Enter a fully-resolved VA (hex). The dialog computes RVA = VA - ImageBase, then converts the RVA to a file offset. Errors out if VA is below ImageBase.
RVA	Enter an RVA (hex). The dialog computes VA = RVA + ImageBase and the file offset.
FileOffset	Enter a file offset (hex). The dialog computes the matching RVA (and hence VA) by walking the section table.

After each calculation:

The non-source fields are filled in with the computed values.
The bottom label shows the section name the address resolves into, plus the first 6 bytes at the file offset (read from disk every time, so it's accurate for the on-disk file).

The two non-source text fields are visually disabled (gray background) but text-selectable — on purpose, so you can copy the result. (The author's note in the source: "i hate that lordpe disables the textbox because you cant copy the text..")

Dump Fix

The small underlined "Dump Fix" link in the bottom-right runs CDumpFix.QuickDumpFix against a copy of the loaded file (saved as <original>.fix). DumpFix is for memory-dumped PE images: it walks the section table and rewrites the raw-offset and raw-size fields to match how the image is laid out on disk after the dump (typically: align to disk, copy section data linearly).

After the fix, the dialog reloads <original>.fix as the new active file and shows a confirmation MsgBox. If the fix fails, the temp .fix file is deleted and a "Failed" message is shown.

The typical workflow: dump a section / process from memory, save it as a flat blob, open it in File Hash, invoke this dialog, click Dump Fix. The result should now be loadable by IDA / x64dbg / disassemblers in general.

Notes

All values are entered and displayed as hex (no 0x prefix). GetHextxt validates with CLng("&h" & t).
The 6-byte peek reads the first 6 bytes at the resolved file offset. If the file offset is invalid (e.g. an RVA inside a section that's all-virtual with no raw backing), the peek may show stale data — the section name in the same label will tell you whether the offset really maps to anything.
The dialog's calculator works for both 32-bit and 64-bit PE files (the menu item is labeled "Offset Calculator (32/64bit)" for that reason). ImageBase is read from CPEEditor, which handles both.