I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the binary.

But how do I find the addresses of the locations when the process is running?

  if (_DAT_00dd5c44 <= DAT_00dd5c3c) {
    return 0;
  • Hi and welcome to RE.SE. Maybe you could start by letting us know what kind of executable this is and what OS is being targeted. Since you only provide decompiler output, none of that is obvious (and the tags have no such info either). CheatEngine sounds like Windows, so may we assume it's a PE file? There is a clear correlation between the RVA and the VA. So it's perhaps not trivial but relatively straightforward to calculate the offset from the image base (of the loaded image) and correlate that to the RVA. – 0xC0000022L Aug 17 '19 at 21:55

Position dependent code

If the executable was compiled as position dependent code, the addresses will not change - they will remain the same in process' virtual memory each time you run it. In this case, it simply suffices to find these addresses once during the runtime and they won't change.

Position independent code

In this (more likely) case, the addresses will change during each execution because of ASLR. The thing that won't change however is their relative offset to each other. Since at compilation time, compiler has to take into account, that the resulting program can be loaded at different addresses it will use the relative offsets when accessing functions and data. For example, you will see something like mov rax, [rip+0x1234] instead of mov rax, [0x555555655655]. So you will need to find out the address of the data by calculating this relative offset.

To avoid the problems related to ASLR, you may simply disable it for the time you need. In Linux you can do it by:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

and you can enable it once again by running:

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

Finally, to get the address of the data referenced like mov, rax, [rip+0x1234] you will have to debug your program, place a breakpoint at that line and simply read the rip value and add the relevant offset to it (in this case rip+0x1234).

| improve this answer | |
  • Would you know how to disable ASLR on Windows? – DohnJoe Aug 17 '19 at 18:09
  • I haven't tried it, but I would go for the third answer in question. – bart1e Aug 17 '19 at 18:11
  • Ok thank you bart1e – DohnJoe Aug 18 '19 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.