I opened crypt32.dll and looked at its export table using CFF explorer.
CFF Explorer
I then manually loaded the dll using LoadLibrary and noticed inconsistency between the functionRVA in CFF explorer and the actual RVA (calculated using windbg).
For example CFF explorer shows that that the RVA of CertUnregisterPhysicalStore is 90640 Where windbg says the RVA is 90030 (calculation was crypt32!CertUnregisterPhysicalStore – crypt32)
windbg
Why are the RVAs not the same?
New contributor
Spleo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.