1

I'm recently start in reverse engineering filed. While working with the disassembler I asked myself:what the "address" label meant. For example here we have hopper image:https://www.hopperapp.com/tutorial_files/[email protected]

As you can see atbbottom of hopper we have 0x100001dc0 and offset:0x1dc0, I know that offset is the way inside hex editor to jump directly in the function highlighted in blue by hopper,but don't know what's address. Someone told me that "address" indicate the virtual address of instruction, but I know that virtual address is calculate/managed at runtime by the OS and this confuse me a bit. Someone can explain me what I did misunderstand? Thanks

Improve this question
1
  • address is the address where the os will load the program in normal circumstances you sure can visualize like for (i = address , i< address+size ; i++) {printf "%x %02x ", i , the_place_in_file_which_will_be_loaded_at_addr [i] }
    – blabb
    Commented Jun 30, 2019 at 20:00

1 Answer 1

Reset to default
1

The 0x1dc0 is an instruction offset in the file, while 0x100001dc0 is address in a program virtual memory when this particular instruction should reside.

For more information, see link. In your case, base address for a file is 0x100000000, so it means it should be loaded at this address and every instruction in it will have its address incremented accordingly.

Improve this answer
6
  • Ok thanks, now I understand that the imagebase is where the executable should be loaded. Where can I learn more (link ebook etc) about this topic in general? Is it about compilers? For example on osx I can't understand how it is calculated (VA) and also on Linux, so I would like to learn more.
    – user3782573
    Commented Jul 1, 2019 at 7:57
  • You can read this: en.m.wikipedia.org/wiki/Loader_(computing). Basically, a virutal address is the address that an executable “sees” and uses, and is then translated to a physical one by OS. It is not about compilers, it’s about program loading.
    – bart1e
    Commented Jul 1, 2019 at 8:49
  • In position independent code, a virtual address will be: imageBase + sectionOffset + offsetInSection, while position dependent code will have hardcoded addresses.
    – bart1e
    Commented Jul 1, 2019 at 9:03
  • It may seem stupid, but something sends me off track, in windows there is imagebase which tells where the process should be loaded. In the other os I don't understand how they do because imagebase is related to the PE header no to elf or other executables, if the loader does everything at runtime, the disassembler that simply shows the assembly code how does it show the virtual address? sorry for the OT. I've been looking for things like: mach-o imagebase but I can't find anything about it.
    – user3782573
    Commented Jul 1, 2019 at 10:55
  • In ELF there are section offsets that tell you the addresses where they should be loaded. You can use readelf to get them.
    – bart1e
    Commented Jul 1, 2019 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.