Q: Extract resources from sys-file How to extract resources for sys-file? I believe that exe, dll and sys-files have same headers. Is that correct?
I don't understand what shall I do with VirtualAddress and Size which I get for resource table. 
#include <stdio.h>
#include <windows.h>
#include <string.h>

void main()
{
    FILE *file = fopen( "example.sys", "r" );

    IMAGE_DOS_HEADER dos_header;
    IMAGE_NT_HEADERS nt_header;
    IMAGE_DATA_DIRECTORY data_directory;

    char *data;

    if( file != NULL )
    {
        fseek( file, 0, SEEK_SET );
        fread( &dos_header, sizeof( dos_header ), 1, file );
        if( dos_header.e_magic != IMAGE_DOS_SIGNATURE )
            return;

        fseek( file, dos_header.e_lfanew, SEEK_SET );
        fread( &nt_header, sizeof( nt_header ), 1, file );
        if( nt_header.Signature != IMAGE_NT_SIGNATURE )
            return;

        data_directory = nt_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE];

        data = malloc( data_directory.Size + 1 );
        memset( data, 0, data_directory.Size + 1 );

        fseek( file, data_directory.VirtualAddress, SEEK_SET ); // <- ????
        fread( data, data_directory.Size, 1, file );

        free( data );

        fclose( file );
    }
}


A: VirtualAddress is actually the relative virtual address (RVA) of the data structure. 
For example, if this structure is for import symbols, this field contains the RVA of the IMAGE_IMPORT_DESCRIPTOR array. 
isize contains the size in bytes of the data structure referred to by VirtualAddress.
Take a look at THIS link. It is a good explanation on how to go deep into a win32 assembly.

A: I finally found code example which answered my question - PEDump.
Using it I made this sample:
#include <stdio.h>
#include <windows.h>
#include <string.h>

#define MakePtr( cast, ptr, addValue ) (cast)( (DWORD)(ptr) + (DWORD)(addValue))
#define RESOURCE_ADDRESS( pdr, o ) ((PUCHAR) (pdr + 1) + (o))

typedef struct tag_VS_VERSIONINFO 
{
    USHORT wLength;         // 00 length of entire version resource
    USHORT wValueLength;    // 02 length of fixed file info, if any
    USHORT wType;           // 04 type of resource (1 = text, 0 = binary)
    WCHAR szKey[17];        // 06 key -- VS_VERSION_INFO + padding byte
    VS_FIXEDFILEINFO Value; // 28 fixed information about this file (13 dwords)
} 
VS_VERSIONINFO, *PVS_VERSIONINFO;   // 5C

PIMAGE_SECTION_HEADER GetEnclosingSectionHeader(DWORD rva,
                                                PIMAGE_NT_HEADERS pNTHeader)
{
    PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(pNTHeader);
    unsigned i;

    for ( i=0; i < pNTHeader->FileHeader.NumberOfSections; i++, section++ )
    {
        // Is the RVA within this section?
        if ( (rva >= section->VirtualAddress) && 
             (rva < (section->VirtualAddress + section->Misc.VirtualSize)))
            return section;
    }

    return 0;
}

LPVOID GetPtrFromRVA( DWORD rva, PIMAGE_NT_HEADERS pNTHeader, DWORD imageBase )
{
    PIMAGE_SECTION_HEADER pSectionHdr;
    INT delta;

    pSectionHdr = GetEnclosingSectionHeader( rva, pNTHeader );
    if ( !pSectionHdr )
        return 0;

    delta = (INT)(pSectionHdr->VirtualAddress-pSectionHdr->PointerToRawData);
    return (PVOID) ( imageBase + rva - delta );
}

void main()
{
    unsigned int index;

    PIMAGE_DOS_HEADER dos_header;
    PIMAGE_NT_HEADERS nt_header;
    PIMAGE_DATA_DIRECTORY data_directory;
    PIMAGE_RESOURCE_DIRECTORY resources;
    PIMAGE_RESOURCE_DIRECTORY_ENTRY listItem;
    PIMAGE_RESOURCE_DIRECTORY child;
    PIMAGE_RESOURCE_DIRECTORY_ENTRY version;
    PIMAGE_RESOURCE_DATA_ENTRY data_entry;
    PVS_VERSIONINFO version_info;

    HANDLE hFile;
    HANDLE hFileMapping;
    LPVOID lpFileBase;

    hFile = CreateFile( L"samples.sys", 
                        GENERIC_READ, 
                        FILE_SHARE_READ, 
                        NULL,
                        OPEN_EXISTING, 
                        FILE_ATTRIBUTE_NORMAL, 
                        0 
    );

    if ( hFile == INVALID_HANDLE_VALUE )
        return;

    hFileMapping = CreateFileMapping( hFile, NULL, PAGE_READONLY, 0, 0, NULL );
    if ( hFileMapping == 0 )
    {
        CloseHandle(hFile);
        return;
    }

    lpFileBase = MapViewOfFile( hFileMapping, FILE_MAP_READ, 0, 0, 0 ); 
    if ( lpFileBase == 0 )
    {
        CloseHandle(hFileMapping);
        CloseHandle(hFile);
        return;
    }

    dos_header = MakePtr( PIMAGE_DOS_HEADER, lpFileBase, 0 );
    if( dos_header->e_magic != IMAGE_DOS_SIGNATURE )
        return;

    nt_header = MakePtr( PIMAGE_NT_HEADERS, lpFileBase, dos_header->e_lfanew );
    if( nt_header->Signature != IMAGE_NT_SIGNATURE )
        return;

    data_directory = &nt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE];

    resources = ( PIMAGE_RESOURCE_DIRECTORY )GetPtrFromRVA( data_directory->VirtualAddress, nt_header, ( DWORD )lpFileBase );

    listItem = ( PIMAGE_RESOURCE_DIRECTORY_ENTRY )( resources + 1 );
    for( index = 0; index < resources->NumberOfIdEntries; index++ )
    {
        if( listItem->Id == ( WORD )RT_VERSION )
        {
            if( listItem->DataIsDirectory )
            {
                child = ( PIMAGE_RESOURCE_DIRECTORY )( ( listItem->OffsetToData & 0x7FFFFFFF ) + (DWORD)resources );
                version = ( PIMAGE_RESOURCE_DIRECTORY_ENTRY )( child + 1 );

                if( version->DataIsDirectory )
                {
                    child = ( PIMAGE_RESOURCE_DIRECTORY )( ( version->OffsetToData & 0x7FFFFFFF ) + (DWORD)resources );
                    version = ( PIMAGE_RESOURCE_DIRECTORY_ENTRY )( child + 1 );

                    data_entry = ( PIMAGE_RESOURCE_DATA_ENTRY )( ( version->OffsetToData & 0x7FFFFFFF ) + (DWORD)resources );

                    version_info = ( PVS_VERSIONINFO )GetPtrFromRVA( data_entry->OffsetToData, nt_header, ( DWORD )lpFileBase );
                }
            }
        }

        listItem += 1;
    }
}

Most interesting part here is function GetPtrFromRVA which shall be used to convert VirtualAddress to offset from the beginning of the file.
