I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can find the offset in the file that each instruction corresponds to. Thanks!
3 Answers
The file offset of the current location is displayed in the disassembly (IDA View) status bar together with the address.
answered Feb 4, 2020 at 19:49
-
When opening a binary, does IDA load it to the same place within the Ida process and then just show you the address that you've selected to load the segments as if it's at that address. I cannot see any allocation within ida64.exe at the address that IDA claims the binary is at Commented Jul 12, 2022 at 15:02
IDA is displaying the Relative Virtual Address based on the base address of the binary (or on that you supply before loading the binary). The reason this is different from the actual address is because it is mapped into memory. The Relative Virtual Address (RVA) is BaseAddress + Offset, if you find the offset address and add it to your at rest binary base address you will find the same point within the binary.
Igor gave the answer for Ida. A more general possibility, very simple and working everywhere, would be just to write down a sequence of immutable bytes from the disassembler (i.e. avoiding changing addresses), then load the file into a Hex Editor and let it search for that sequence. If it is long enough there will mostly be only a single hit within the file.
0(I wonder if it allows that), then the code would still not correspond to the file. Whole sections may not load at all, be discarded, or moved to another address.