2

Do someone know a windbg command to display the RVA of a certain instruction within it's module?

Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, eax:

16237915 8b4e0c          mov     ecx,dword ptr [esi+0Ch]
16237918 e8633ff0ff      call    NPSWF32!BrokerMainW+0x1b0a4 (1613b880)
1623791d 85c0            test    eax,eax
1623791f 7507            jne     NPSWF32!BrokerMainW+0x11714c (16237928)
16237921 8bce            mov     ecx,esi
16237923 e80838fdff      call    NPSWF32!BrokerMainW+0xea954 (1620b130)
16237928 8b4810          mov     ecx,dword ptr [eax+10h]

I have to find first the base address of the module:

0:000> lm a 1623791d 
Browse full module list
start    end        module name
15c70000 16b53000   NPSWF32    (export symbols)     

And calculate the RVA myself: 1623791d - 15c70000 = 5C791D

My question, is there a windbg command that will give me this result immediately.

Thanks in advance!

1 Answer 1

3

put this is some txt file and save it somewhere like c:\myrva.txt

.foreach ( place { lm1ma ${$arg1} } ){ .printf "Rva for input is %x\n", ${$arg1}-${place} }

and use it like

0:000> $$>a< c:\\rva.txt @edx
Rva for input is 470b4
0:000> ? edx
Evaluate expression: 1997238452 = 770b70b4
0:000> $$>a< c:\\rva.txt .
Rva for input is a04fa
0:000> ? .
Evaluate expression: 1997604090 = 771104fa
0:000> $$>a< c:\\rva.txt 7711050a
Rva for input is a050a

Well if you think this should be a regular windbg command you can write your own extension
and do !rva
with engextcpp framework this should take no more than 5 lines of code as below

#include <engextcpp.cpp>
class EXT_CLASS : public ExtExtension {
public:
    EXT_COMMAND_METHOD(rva);
};
EXT_DECLARE_GLOBALS();
EXT_COMMAND( rva, "rva", "{;e,d=@$ip;!rva;}" ) {
    ULONG64 inaddr = GetUnnamedArgU64 (0);
    ULONG ModIndex = NULL;
    ULONG64 Modbase = NULL;
    m_Symbols->GetModuleByOffset(inaddr,0,&ModIndex,&Modbase);
    Out("Rva For Inaddress %I64x is %I64X\n" ,inaddr ,(inaddr - Modbase));    
}

compiled and linked with

cl /LD /nologo /W4 /Ox  /Zi /EHsc rva.cpp /link /EXPORT:DebugExtensionInitialize /Export:rva /Export:help /RELEASE %linklibs%

and execute happily it takes one argument an expression and by default the expression is current instruction pointer viz $ip

extension auto loaded during start of session

windbg -c ".load rva" calc

and happy rvaing for ever

0:000> !rva
Rva For Inaddress 776e04f6 is A04F6
0:000> !rva @edx
Rva For Inaddress 776870b4 is 470B4
0:000> !rva ntdll
Rva For Inaddress 77640000 is 0
0:000> !rva calc
Rva For Inaddress 440000 is 0
0:000> !rva calc!WinMain
Rva For Inaddress 441635 is 1635

even some obscure unrealistic expression will work
0:000> !rva @@c++( ( @$proc )->Ldr)
Rva For Inaddress 77717880 is D7880
2
  • Thank you for your solution, it works. I just feel like the feature should have existed as a windbg regular command
    – Aviv
    Sep 1, 2016 at 14:11
  • you can code your own extension that does this ala windbg !rva style i edited my answer to include this approach you may take a look
    – blabb
    Sep 2, 2016 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.