0

I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So normally it would be "opcode" "offset address little endian". In this example, the bytes after the opcode don't equal 0x20030. They are 0x10EE5B0D. Any idea why not? Is there any way to identify the 0x20030 offset? IDA clearly knows where the data is because its naming it "unk_180020030".

00000001800011CE 48 8D 0D 5B EE 01 00    lea rcx, unk_180020030
3

As you showed us, the opcodes 48 8D 0D 5B EE 01 00 are translated by IDA to:

 lea rcx, unk_180020030

But how does IDA recognizes this address? Well it's all about relative offsets. These opcodes are truly translated into the following assembly. I used "rasm2" from radare2 framework but you can use any other (1) option (2).

$ rasm2 -b 64 -d 488D0D5BEE0100
lea rcx, [rip + 0x1ee5b]

As you can see, 0x1ee5b (and not 0x10EE5B0D) is relative, in this case, to the RIP register. Since it's the Instruction Pointer, you can tell that RIP would be equal to 0x1800011CE which is the address of the instruction you showed us. Simply add 0x1ee5b to it and you'll get the address that IDA calculated.

  • Is there a way to get the value without knowing rip if I know values for ImageBase, section offsets etc? – Chuck Feb 19 '18 at 14:06
  • You can calculate the offset from the base address to this address – Megabeets Feb 19 '18 at 16:26
  • So 0x180000000 - 0x1ee5b? That is 0x17ffe11a5. I’m not sure how I would get 0x11ce. Would you mind providing an example? I want to programmatically determine this via python so I have to act as though I don’t know the 0x1800011ce address and have to calculate it. – Chuck Feb 19 '18 at 17:17
  • That's another question. Please open a new question, describing thoroughly all the information you have and all that you tried. – Megabeets Feb 20 '18 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.