I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset 20030
. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So normally it would be "opcode" "offset address little endian". In this example, the bytes after the opcode don't equal 0x20030
. They are 0x10EE5B0D
. Any idea why not? Is there any way to identify the 0x20030
offset? IDA clearly knows where the data is because its naming it "unk_180020030"
.
00000001800011CE 48 8D 0D 5B EE 01 00 lea rcx, unk_180020030