1

I want to read the data value at a given address in IDA Pro. I found it can be achieved by DWord(address) function. However in case the value is RVA of a function (as below), Dword() gives RVA 7E094D (where image_base is 300000), as expected.

.rdata:00CC0024                 dd rva sub_AE094D

Is there any simple way how IDA Pro/Python scripting can tell me that a data value is RVA so that I can add the image_base to it to get the absolute address?

2 Answers 2

1

The code below is prone to "false positives", but it's better than nothing:

def is_rva(ea):
    original_ea = ScreenEA()
    Jump(ea)
    found = " rva " in GetCurrentLine()
    Jump(original_ea)
    return found

Hopefully someone can provide a better answer than this (code that actually checks IDA's internal representation instead of doing a string comparison), but if not, perhaps this will suit your needs.

0

If you know the base, you can "force" the display of the offset by using the 'Offset (user-defined)' command (Ctrl+R by default). You can then specify the base from which the offset have to be calculated, and IDA will basically add and substract the base, so it'll give:

RVA 0x1234 with BaseAddress 0x400000 => (loc_401234 - 0x400000)

Unfortunately, there is no easy way to differentiate a small constant and a RVA, beside maybe looking if the destination already has a name, but that's error-prone since the only reference to that location could be the very same RVA you're manipulating. Either manual inspection of each value or custom-made heuristics would be my best guess.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.