# How to Calculate ds Pointer

How do I calculate the location of the string in this sample located at offset `0x1CAD8`?

The instruction at `0x140001A97` in the sample is:

``````0x140001A97   F2 0F1005 39C60100   movsd xmm0, qword [rip + str..exe]
``````

The opcode has `0x39C60100` which is `0x1C639`. If I add that to `rip`, I don't land on the address of the string:

``````0x140001A97 -> offset = 0xE97
``````
``````0xE97 + 0x8 + 0x1C639 = 0x1D4D8
``````

The string's offset is `0x1CAD8` not `0x1D4D8`

What am I missing?

The sample is Ryuk: `18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1` If you need a copy of the sample, a base64 encoded passworded zip archive with the sample is located here: https://pastebin.com/aKskMXY7

The password for that zip file is `reseinfected`. If you need something to decode base64 quickly, use this cyberchef recipe:

``````From_Base64('A-Za-z0-9+/=',true)
``````

I think you are confusing yourself somehow and mixing up file offsets with virtual offsets

lets try a simple example

open a random exe in windbg
patch the bytes in the current instruction Pointer
disassemble
subtract and look

explanation for commands below
cdb is console equivalent for windbg
-c is the command line to be passed to the debugger
eb . is enter bytes at the current instruction pointer (. (dot denotes current ip))
it is followed by bytes from your post

then I disassemble one single instruction at current ip using u . l1
I query what the current ip isby ? \$ip
and quit

take the results and do the subtraction with python

``````C:\>cdb -c "eb . F2 0F 10 05 39 C6 01 00;u . l1;? \$ip;q" cdb | f:\git\usr\bin\awk "/Reading/,/quit/"
0:000> cdb: Reading initial command 'eb . F2 0F 10 05 39 C6 01 00;u . l1;? \$ip;q'
ntdll!LdrpDoDebuggerBreak+0x30:
00007ffc`69ad2dbc f20f100539c60100 movsd   xmm0,mmword ptr [xxx (00007ffc`69aef3fd)]
quit:

`(14001E0D8-140001A97)-8 = 1C639, VA 14001E0D8 is offset 0001CAD8`