2

So I have an address from IDA which is: .text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?

2

In a nutshell, the address you are seeing in IDA Pro is the "on disk virtual address" which is not necessarily the "real" address that the program actually maps to when it is loaded into memory (RAM). Many times, there is an address change due to Address Space Layout Randomization (ASLR) but it could also occur due to other reasons. To disable ASLR, you can use the program CFF Explorer; open the binary and navigate to the OptionalHeader and then scroll down to DllCharacteristics area and you will have an option to edit here. Untick the checkbox "image can be moved" and make sure to save the binary before you exit. This will disable ASLR.

Another option you have is to first load the binary into a debugger and locate the image base address of the binary in the debugger (use the "memory map" option) and then go into IDA Pro and click Edit -> Segments -> Rebase Program now enter the image base into the box, tick Image Base, and click OK. Now, the addresses in your debugger will correspond properly with the addresses in IDA Pro Disassembler.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.