Here is a little and very useful
32-bit calculator
32-bit ASM Calculator 1.6 (c)PCL
--Add--
And here is a specific calculator for calculate offsets in 32-bit PE-EXE file:
File Location Calculator (c)PCL
His little-modified version 1.4.0.4(+) is attached to this message (See attachement).
Added option - displays "<TaiL>" string after section name if (given address > FileOffset+VirtualSize) for this section.
Example of PE-sections table in 32-bit PE-EXE with tails in sections:
Quote:
N Name.... VirtSize...... RVA....... PhysSize.... Offset..... Flag
1 .text...... 00028874 00001000 00028A00 00000400 60500060
2 .data..... 00000084 0002A000 00000200 00028E00 C0300040
3 .rdata.... 00008970 0002B000 00008A00 00029000 40700040
4 .eh_fram 000065A8 00034000 00006600 00031A00 40300040
5 .bss...... 00010F20 0003B000 00000000 00000000 C0700080
6 .idata.... 00000A68 0004C000 00000C00 00038000 C0300040
7 .CRT...... 00000018 0004D000 00000200 00038C00 C0300040
8 .tls........ 00000020 0004E000 00000200 00038E00 C0300040
|
See ".text" section for example:
VirtSize =
00028874h
PhisSize=
00028A00h
Then:
<Tail>Size= PhisSize-VirtSize=
018Ch
--Add--
For "Triming tails" of all sections in PE-section table of file
use HIEW32 HEM-Plugin
PE_TAILS.HEM.