bdpayne/libvmi — pull request #47 by tklengyel (2013-04-15 17:37:53+00:00)
Title: translate rva to exported symbol (windows)

Currently LibVMI allows translating a symbol to a VA, but not the other way around. This can be easily implemented using existing techniques on the Windows side by walking the Export Table of the PE header and reusing some of the cache mechanism of sym_cache. Mapping an RVA to a symbol is extremely useful for example when we examine the stack of a process or in any other instances when we need to map an EIP to a symbol.

FYI: this approach does not map unexported symbols as that requires debug data, which would be more easily implemented in Python (or directly with Volatility https://code.google.com/p/volatility/issues/detail?id=149). Nevertheless, when no debug data is available, this can still be used as a fall-back mechanism.