WinDbg - RVA of current instruction

Question

Do someone know a windbg command to display the RVA of a certain instruction within it's module?

Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, eax:

16237915 8b4e0c          mov     ecx,dword ptr [esi+0Ch]
16237918 e8633ff0ff      call    NPSWF32!BrokerMainW+0x1b0a4 (1613b880)
1623791d 85c0            test    eax,eax
1623791f 7507            jne     NPSWF32!BrokerMainW+0x11714c (16237928)
16237921 8bce            mov     ecx,esi
16237923 e80838fdff      call    NPSWF32!BrokerMainW+0xea954 (1620b130)
16237928 8b4810          mov     ecx,dword ptr [eax+10h]

I have to find first the base address of the module:

0:000> lm a 1623791d 
Browse full module list
start    end        module name
15c70000 16b53000   NPSWF32    (export symbols)     

And calculate the RVA myself: 1623791d - 15c70000 = 5C791D

My question, is there a windbg command that will give me this result immediately.

Thanks in advance!

Answer 1

put this is some txt file and save it somewhere like c:\myrva.txt

.foreach ( place { lm1ma ${$arg1} } ){ .printf "Rva for input is %x\n", ${$arg1}-${place} }

and use it like

0:000> $$>a< c:\\rva.txt @edx
Rva for input is 470b4
0:000> ? edx
Evaluate expression: 1997238452 = 770b70b4
0:000> $$>a< c:\\rva.txt .
Rva for input is a04fa
0:000> ? .
Evaluate expression: 1997604090 = 771104fa
0:000> $$>a< c:\\rva.txt 7711050a
Rva for input is a050a

Well if you think this should be a regular windbg command you can write your own extension
and do !rva
with engextcpp framework this should take no more than 5 lines of code as below

#include <engextcpp.cpp>
class EXT_CLASS : public ExtExtension {
public:
    EXT_COMMAND_METHOD(rva);
};
EXT_DECLARE_GLOBALS();
EXT_COMMAND( rva, "rva", "{;e,d=@$ip;!rva;}" ) {
    ULONG64 inaddr = GetUnnamedArgU64 (0);
    ULONG ModIndex = NULL;
    ULONG64 Modbase = NULL;
    m_Symbols->GetModuleByOffset(inaddr,0,&ModIndex,&Modbase);
    Out("Rva For Inaddress %I64x is %I64X\n" ,inaddr ,(inaddr - Modbase));    
}

compiled and linked with

cl /LD /nologo /W4 /Ox  /Zi /EHsc rva.cpp /link /EXPORT:DebugExtensionInitialize /Export:rva /Export:help /RELEASE %linklibs%

and execute happily it takes one argument an expression and by default the expression is current instruction pointer viz $ip

extension auto loaded during start of session

windbg -c ".load rva" calc

and happy rvaing for ever

0:000> !rva
Rva For Inaddress 776e04f6 is A04F6
0:000> !rva @edx
Rva For Inaddress 776870b4 is 470B4
0:000> !rva ntdll
Rva For Inaddress 77640000 is 0
0:000> !rva calc
Rva For Inaddress 440000 is 0
0:000> !rva calc!WinMain
Rva For Inaddress 441635 is 1635

even some obscure unrealistic expression will work
0:000> !rva @@c++( ( @$proc )->Ldr)
Rva For Inaddress 77717880 is D7880