Do someone know a windbg command to display the RVA of a certain instruction within it's module?
Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, eax
:
16237915 8b4e0c mov ecx,dword ptr [esi+0Ch]
16237918 e8633ff0ff call NPSWF32!BrokerMainW+0x1b0a4 (1613b880)
1623791d 85c0 test eax,eax
1623791f 7507 jne NPSWF32!BrokerMainW+0x11714c (16237928)
16237921 8bce mov ecx,esi
16237923 e80838fdff call NPSWF32!BrokerMainW+0xea954 (1620b130)
16237928 8b4810 mov ecx,dword ptr [eax+10h]
I have to find first the base address of the module:
0:000> lm a 1623791d
Browse full module list
start end module name
15c70000 16b53000 NPSWF32 (export symbols)
And calculate the RVA myself:
1623791d - 15c70000 = 5C791D
My question, is there a windbg command that will give me this result immediately.
Thanks in advance!