2

I have the following sequence of bytes in IDA Pro:

.text:0044A838          db 2Ah
.text:0044A839          db 0ADh ; ­
.text:0044A83A          db    4
.text:0044A83B          db    0
.text:0044A83C          dd rva word_44AD3E     
.text:0044A840          dd rva word_44AD4C
.text:0044A844          dd rva word_44AD5C

This region should be interpreted as four consecutive relative pointers, but right now, it is four raw bytes, and then three relative pointers. How can I instruct IDA that the first element is a relative offset pointer?

When I mark the first element as being a 32-bit integer, the its simply the value 0x4AD2A, which IDA does not recognize as being an xref that I can follow. I cannot mark this 32-bit element as an offset (by pressing O), since the address 0x4AD2A is not valid in this executable.

Improve this question

2 Answers 2

Reset to default
2

Define the element to be the appropriate size (such as by pressing d repeatedly). Then press Ctrl-R (or use the menu entry: Edit->Operand Type->Offset->Offset (User Defined)), select Use image base as offset base, and accept the dialog.

example diallog

Improve this answer
1
  • 1
    And if the resulting address is above 4G, make sure to choose OFF64, even if it is a 32-bit variable. The width of the memory cell need not match the size of the resulting address.
    – Michael Karcher
    Mar 7, 2021 at 15:52
0

Press UDDDO or you may be able to get away with UQO

Note: the leading U is to ensure you are starting from a consistent state, and is not strictly necessary.

Key meanings:

U - Undefine
D - Data [byte]
D - Data [word]
D - Data [dword]
O - Offset

or

U - Undefine
Q - Hex (will convert to D/QWORD for free)
O - Offset

I (heart) Vim

Improve this answer
2
  • using O/Offset usually interprets the data as a VA rather than RVA, which is what I am looking for here.
    – Willi Ballenthin
    Mar 8, 2021 at 19:44
  • When-ever I do this in my own code, (64 bit, __ImageBase at 0x140000000 and QWORD values), they come out perfectly as (Absolute) values. If you are doing 32 bit stuff, I am officially clueless, and the only relative offsets in the 64 bit work I do are the RIP relative type. However, I did notice the other day while browsing the configuration options of IDA that there's a tremendous list of things you can assign to keyboard shortcuts -- so you might be able to figure something. Otherwise, I could write a quick Python based hotkey for you if I understood your crazy 32bit world.
    – Orwellophile
    Mar 9, 2021 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.