1

I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can find the offset in the file that each instruction corresponds to. Thanks!

  • Did you expect that a file is loaded unmodified into memory? Starting at address #0? It has not been that way since ... well, even though mid-1980's COM files under DOS were loaded and executed unmodified, they still could not load at address #0 -- it would overwrite the system! – usr2564301 Feb 3 at 10:13
  • @usr2564301 Well... I honestly didn't expect the disassembler would handle relocating the code, but it makes sense that it does. I'm fairly new to RE so forgive me for my naivety. I would still like to find out what parts of the static file the disassembly corresponds to. Is there a way to do that in IDA? – kansas_bulldog382 Feb 3 at 16:15
  • IDA by default tries to load a PE at the preferred load address as supplied in the PE header. But even if you force it to relocate to 0 (I wonder if it allows that), then the code would still not correspond to the file. Whole sections may not load at all, be discarded, or moved to another address. – usr2564301 Feb 3 at 16:37
2

The file offset of the current location is displayed in the disassembly (IDA View) status bar together with the address.

|improve this answer|||||
1

IDA is displaying the Relative Virtual Address based on the base address of the binary (or on that you supply before loading the binary). The reason this is different from the actual address is because it is mapped into memory. The Relative Virtual Address (RVA) is BaseAddress + Offset, if you find the offset address and add it to your at rest binary base address you will find the same point within the binary.

|improve this answer|||||
0

Igor gave the answer for Ida. A more general possibility, very simple and working everywhere, would be just to write down a sequence of immutable bytes from the disassembler (i.e. avoiding changing addresses), then load the file into a Hex Editor and let it search for that sequence. If it is long enough there will mostly be only a single hit within the file.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.