IDA Pro 64bit offset and opcode issue

Question

I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So normally it would be "opcode" "offset address little endian". In this example, the bytes after the opcode don't equal 0x20030. They are 0x10EE5B0D. Any idea why not? Is there any way to identify the 0x20030 offset? IDA clearly knows where the data is because its naming it "unk_180020030".

00000001800011CE 48 8D 0D 5B EE 01 00    lea rcx, unk_180020030

Answer 1

As you showed us, the opcodes 48 8D 0D 5B EE 01 00 are translated by IDA to:

 lea rcx, unk_180020030

But how does IDA recognizes this address? Well it's all about relative offsets. These opcodes are truly translated into the following assembly. I used "rasm2" from radare2 framework but you can use any other (1) option (2).

$ rasm2 -b 64 -d 488D0D5BEE0100
lea rcx, [rip + 0x1ee5b]

As you can see, 0x1ee5b (and not 0x10EE5B0D) is relative, in this case, to the RIP register. Since it's the Instruction Pointer, you can tell that RIP would be equal to 0x1800011CE which is the address of the instruction you showed us. Simply add 0x1ee5b to it and you'll get the address that IDA calculated.