Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I find that abc.sys starts at 0xFFFF... and so to go to sub_1400AAAAA I first add the start address and 0xAAAAA and then do "db [the result of the addition]". However, when I compare the bytes shown in WinDbg with those of IDA, they are different. What am I doing wrong?

EDIT: Even when subtracting -0x1000 on top of the addition, it does not land in the right place.


1 Answer 1


Type lm m abc.sys in windbg and find out what is the loaded address. Let's say windbg shows

abc.sys  0x97370000   

Now go to IDA and rebase the loaded image in IDA.

If I recall correctly, menu segments->rebase use the address you found in windbg.

After rebasing you don't have to add subtract or grope around, both will have same address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.