Posted: Tue Aug 27, 2013 2:25 pm Post subject: Confusion with virtual addresses and offsets
I have a function that pushes the address of a string like this:
...
push offset someString
...
someString is inside .rdata
Now when I start the exe and look at the code with CE's disassembler it points to the correct string.
But when I try to follow the offset myself it doesn't work.
Here is what I've done:
I view the code in "offline" mode (without running the exe) by opening the file directly with CE.
I go to the code section where the push is located.
But when I use go to address "CA5210" doesn't work and neither does "400+CA5210".
I always get into a unallocated region (only ??? everywhere).
Next thing I tried is to open the image in IDA.
It immediately shows the correct string. But the offset it displays doesn't work either when working with file-addresses.
".text:0000100D 68 10 52 8A 00 push offset szdel"
Then I used CE's search to find the string in the file. It finds the string, but at a completely different address.
I also noticed the opcode to be different. Normal pushes use 0x6A. This one uses 0x68.
How do I get the file offset from this "push offset" ?
Joined: 12 Dec 2012 Posts: 340 Location: Somewhere....
Posted: Tue Aug 27, 2013 3:49 pm Post subject:
Quote:
But when I use go to address "CA5210" doesn't work and neither does "400+CA5210".
I always get into a unallocated region (only ??? everywhere).
this CA5210 is the file offset of your string itself, if you want to reach the virtual address (while exe running), you have to add the image base to this(by default: it's 0xCA5210 + 0x400000 = 0x10A5210)
Quote:
How do I get the file offset from this "push offset" ?
same as above, check the image base, this one should be 0x40040D
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum