The IMAGE_SECTION_HEADER.EndAddress is calculated as
VirtualAddress + SizeOfRawData
it should be
VirtualAddress + SizeOfRawData - 1
If two adjacent sections don't have space between, the EndAddress of the first section is the same as the VirtualAddress of the second section. When given the virtualAddress of the second section PEImage.GetSection will return the first section due to the incorrect EndAddress.
The
IMAGE_SECTION_HEADER.EndAddressis calculated asVirtualAddress + SizeOfRawDatait should be
VirtualAddress + SizeOfRawData - 1If two adjacent sections don't have space between, the
EndAddressof the first section is the same as theVirtualAddressof the second section. When given thevirtualAddressof the second sectionPEImage.GetSectionwill return the first section due to the incorrect EndAddress.