Identify RVA data in IDA Pro

Question

I want to read the data value at a given address in IDA Pro. I found it can be achieved by DWord(address) function. However in case the value is RVA of a function (as below), Dword() gives RVA 7E094D (where image_base is 300000), as expected.

.rdata:00CC0024                 dd rva sub_AE094D

Is there any simple way how IDA Pro/Python scripting can tell me that a data value is RVA so that I can add the image_base to it to get the absolute address?

Answer 1

The code below is prone to "false positives", but it's better than nothing:

def is_rva(ea):
    original_ea = ScreenEA()
    Jump(ea)
    found = " rva " in GetCurrentLine()
    Jump(original_ea)
    return found

Hopefully someone can provide a better answer than this (code that actually checks IDA's internal representation instead of doing a string comparison), but if not, perhaps this will suit your needs.

Answer 2

If you know the base, you can "force" the display of the offset by using the 'Offset (user-defined)' command (Ctrl+R by default). You can then specify the base from which the offset have to be calculated, and IDA will basically add and substract the base, so it'll give:

RVA 0x1234 with BaseAddress 0x400000 => (loc_401234 - 0x400000)

Unfortunately, there is no easy way to differentiate a small constant and a RVA, beside maybe looking if the destination already has a name, but that's error-prone since the only reference to that location could be the very same RVA you're manipulating. Either manual inspection of each value or custom-made heuristics would be my best guess.