Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I find that abc.sys starts at 0xFFFF... and so to go to sub_1400AAAAA I first add the start address and 0xAAAAA and then do "db [the result of the addition]". However, when I compare the bytes shown in WinDbg with those of IDA, they are different. What am I doing wrong?
EDIT: Even when subtracting -0x1000 on top of the addition, it does not land in the right place.