0

I've found a function I want to call in x64dbg, and wanted to see it's prototype and how it looks like in IDA. However, I was expecting to see a function in IDA but land in the middle of one.

The function I want to call in x64dbg:enter image description here

I was expecting I could find the static address in IDA doing like so:

RVA: 881C0000

Finding this statically in IDA: 0000000140000000 (base) + 1C88 (RVA) yielding: 140001C88

When seaching for address 140001C88 in IDA I land in the middle of a function, sub_140001B80. I was expecting to land at something like sub_140001C88 Can someone see what I'm doing wrong?

enter image description here

(FYI: I'm trying to call a function that presses a button)

Improve this question
1

Calls on x86/x64 are encoded based on how far the target is from the source, not as an RVA into the image. I.e., the number 0x1C88 is a distance, not an RVA. To find the RVA, follow the call to its destination, and then subtract that address by the module imagebase. Then, in IDA, press G and enter 0x140000000+[RVA HERE].

Improve this answer
1

If you want to use x64dbg for debugging and at the same time IDA Pro for static analysis, I recommend you one of my favourite plugin: https://github.com/bootleg/ret-sync

You can for example run your binary program in a VM with x64dbg and synchronize it to highlight the current instruction in IDA Pro and much more like auto rebase, controlling/BP from IDA, Windbg...

Improve this answer
1
  • Thanks! That's a tool that will come in handy! – Lubbi Mar 29 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.