2

I have the following sequence of bytes in IDA Pro:

.text:0044A838          db 2Ah
.text:0044A839          db 0ADh ; ­
.text:0044A83A          db    4
.text:0044A83B          db    0
.text:0044A83C          dd rva word_44AD3E     
.text:0044A840          dd rva word_44AD4C
.text:0044A844          dd rva word_44AD5C

This region should be interpreted as four consecutive relative pointers, but right now, it is four raw bytes, and then three relative pointers. How can I instruct IDA that the first element is a relative offset pointer?

When I mark the first element as being a 32-bit integer, the its simply the value 0x4AD2A, which IDA does not recognize as being an xref that I can follow. I cannot mark this 32-bit element as an offset (by pressing O), since the address 0x4AD2A is not valid in this executable.

2

Define the element to be the appropriate size (such as by pressing d repeatedly). Then press Ctrl-R (or use the menu entry: Edit->Operand Type->Offset->Offset (User Defined)), select Use image base as offset base, and accept the dialog.

example diallog

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.