1

When I open an .exe file in IDA, each time I get a different function address because each time I get a different base address offset.

So if I open an .exe file with IDA and want to tell a friend "look on sub_8876," he can't do it because of the different offset.

What is the solution for that?

Improve this question
8
  • What do you mean by "base address offset" ?
    – josh
    Jul 12, 2018 at 22:31
  • Idb or i64 create after I open it. I talking about open the same exe with 2 ida and get tge same functions offset
    – Keystone
    Jul 13, 2018 at 2:20
  • Not each sub has string... I looking on smarter way
    – Keystone
    Jul 13, 2018 at 4:25
  • It doesn't necessarily have to be a string, you could tell him to search for specific commands for example (such as the first 30 bytes of the function)
    – Elian Kamal
    Jul 13, 2018 at 21:53
  • There is not smarter way like jump to offset?
    – Keystone
    Jul 14, 2018 at 17:46

2 Answers 2

Reset to default
1

One (or both) of you can just rebase the program and that should display all the addresses as being the same. If you want him to rebase his program to be the same as yours, figure out your base address (scroll to the top of your .exe in Text View) and then have your friend go to Edit -> Segments -> Rebase Program... and when prompted have him put in your base address.

Alternatively, you can both just rebase to the same base address, e.g. 0x10000000.

Improve this answer
2
  • What is the effective of rebase about the program? And why without rebase the program get another address each time?
    – Keystone
    Jul 18, 2018 at 18:50
  • @Keystone the effect of a rebase is that IDA then perceives each of the files at starting in the same location in memory, and given that they are identical files, they then have the same offsets for functions. Most programs don't care where they are loaded in memory, so when IDA or another program loads them, the OS just puts them wherever it wants, which is normally random either by chance or because of ASLR. If you have more questions that are significantly not answered by these answers, you should edit your question with more specifics or details.
    – theTheodidact
    Jul 18, 2018 at 19:45
1

Actually, you said what is the solution: use offsets. You can get the offset for that function, global or whatever using the following IDA Python:

Python> hex(here() - idaapi.get_imagebase()) 0x38a0aL

It subtracts from the address under the cursor the base address of the database. Then, you can tell your friend the offset and she/he will have to go to the beginning of the database (just press the "Home" key a few times), press key 'g' and enter +0xGIVENOFFSET (notice the + at the beginning) to go to the function you want to point her/him.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.