I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can find the offset in the file that each instruction corresponds to. Thanks!

  • Did you expect that a file is loaded unmodified into memory? Starting at address #0? It has not been that way since ... well, even though mid-1980's COM files under DOS were loaded and executed unmodified, they still could not load at address #0 -- it would overwrite the system!
    – Jongware
    Feb 3, 2020 at 10:13
  • @usr2564301 Well... I honestly didn't expect the disassembler would handle relocating the code, but it makes sense that it does. I'm fairly new to RE so forgive me for my naivety. I would still like to find out what parts of the static file the disassembly corresponds to. Is there a way to do that in IDA? Feb 3, 2020 at 16:15
  • IDA by default tries to load a PE at the preferred load address as supplied in the PE header. But even if you force it to relocate to 0 (I wonder if it allows that), then the code would still not correspond to the file. Whole sections may not load at all, be discarded, or moved to another address.
    – Jongware
    Feb 3, 2020 at 16:37

3 Answers 3


The file offset of the current location is displayed in the disassembly (IDA View) status bar together with the address.

  • When opening a binary, does IDA load it to the same place within the Ida process and then just show you the address that you've selected to load the segments as if it's at that address. I cannot see any allocation within ida64.exe at the address that IDA claims the binary is at Jul 12, 2022 at 15:02

IDA is displaying the Relative Virtual Address based on the base address of the binary (or on that you supply before loading the binary). The reason this is different from the actual address is because it is mapped into memory. The Relative Virtual Address (RVA) is BaseAddress + Offset, if you find the offset address and add it to your at rest binary base address you will find the same point within the binary.


Igor gave the answer for Ida. A more general possibility, very simple and working everywhere, would be just to write down a sequence of immutable bytes from the disassembler (i.e. avoiding changing addresses), then load the file into a Hex Editor and let it search for that sequence. If it is long enough there will mostly be only a single hit within the file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.