Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, whatever) to set breakpoint on it? I would like to know/learn about existing reversing techniques to do it.

  • I followed this thread reverseengineering.stackexchange.com/questions/26083/…
    – ruakh
    Commented Sep 8, 2021 at 10:04
  • 1
    Two options. First one: you open up the binary in a disassembler (let's say IDA), you find the function you are interested in. Grab it's address, subtract it from the base address and you'll have the relative offset. Then fire up x64dbg, add this offset to the loaded base address and you can put a bp on it. Second option: load the binary in x64dbg, open the 'Symbols' tab, and search for your target function (if it have a meaningful name). You can also break on this and you are good to go :)
    – Guillaume
    Commented Sep 8, 2021 at 11:22

1 Answer 1


x64dbg can load the pdb and list all the function names if you have pdb for your executable

view->modules->download symbols for this module enter image description here also x64dbg can use the source file (ctrl+shift+s) enter image description here

just for completion sake windbg usage

:\>cdb -c ".lines;bp `winchk.cpp:17`" winchk.exe

Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64

CommandLine: winchk.exe

00007ffa`055f108c cc              int     3
0:000> cdb: Reading initial command '.lines;bp `winchk.cpp:17`'
Line number information will be loaded
0:000> bl
 0 e 00007ff7`ad0f1090     0001 (0001)  0:**** winchk!main
0:000> g
Breakpoint 0 hit
00007ff7`ad0f1090 4883ec38        sub     rsp,38h

you can use the dbh.exe in windbg installation folder to rebase and get exact address

winchk [1000000]: x *

 index            address     name
     1            1001090 :   main
     3            1001060 :   atest
     5            1001000 :   ctest
     6            1001030 :   btest

winchk [1000000]: base 0x400000

winchk [400000]: x *

 index            address     name
     1             401090 :   main
     3             401060 :   atest
     5             401000 :   ctest
     6             401030 :   btest

winchk [400000]:
  • That's exactly what I needed, thank you!
    – ruakh
    Commented Sep 8, 2021 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.