Timeline for Calculating offset from push instruction in exe to string in data section
Current License: CC BY-SA 4.0
2 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 3, 2019 at 12:59 | comment | added | c0dy | Thank you for your answer :) So if I understand this correctly, the address used by the push instruction is basically the one being used with the "in memory alignment" you mentioned. If that's the case, I assume I can just parse the PE Header, read the involved sizes and calculate the correct address in the file from there? I forgot to mention that the tool is written in C#. I apologize. | |
| Apr 3, 2019 at 5:24 | history | answered | user27990 | CC BY-SA 4.0 |