1

In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the same. My approach is to calculate the offset and add it to the base memory.

start
.text:00000001C0001000 _text           segment para public 'CODE' use64
.text:00000001C0001000                 assume cs:_text
.text:00000001C0001000                 ;org 1C0001000h
.text:00000001C0001000                 assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
.text:00000001C0001000                 db 8 dup(0CCh)
.text:00000001C0001008
.text:00000001C0001008 ; =============== S U B R O U T I N E =======================================
.text:00000001C0001008
.text:00000001C0001008
.text:00000001C0001008 ; __int64 __fastcall TcpNotifyBacklogChangeSend(PKSPIN_LOCK SpinLock)
.text:00000001C0001008 TcpNotifyBacklogChangeSend proc near    ; CODE XREF: TcpNotifyTcbDelay+337↓p
.text:00000001C0001008                                         ; DATA XREF: .pdata:ExceptionDir↓o
...
...
.data:00000001C0203AB4 dword_1C0203AB4 dd 0FFFFh               ; DATA XREF: CTcpQueryTimeStamp+6↑r
.data:00000001C0203AB4                                         ; CTcpQueryTimeStamp+51↑w ...
.data:00000001C0203AB8 icmpPingLowWaterMark dd 1F4h            ; DATA XREF: IppInspectLocalDatagramsIn+5FED5↑r
.data:00000001C0203ABC EQoSpPolicyAppMarkingSetting dd 0FFFFFFFEh
.data:00000001C0203ABC                                         ; DATA XREF: EQoSUpdateAppMarkingSetting+A↑r
.data:00000001C0203ABC                                         ; EQoSProcessGlobalSettings+35↓r ...
.data:00000001C0203AC0 EQoSpPolicyTcpAutoTuningSetting dd 0FFFFFFFFh

So the offset should be 202AB4

kd> lm m tcpip

start     end      module name
fffff803'6b750000 fffff803'6ba6a000  tcpip (pdb symbols)

However, the value is not what I want(0xFFFF) and the initial address function in IDA and windbg is not the same

kd> u fffff8036b750000
tcpip! WFPDatagramDataShimV4 <PERF> (tcpip+0x0):
fffff803`6b750000 4d5a      pop   r10

What's the correct approach to calculate the address value dword_1C0203AB4?

Improve this question
10
  • How 2ab4 ? .text is not start of module
    – blabb
    Aug 12 at 9:59
  • 4d5a is MZ the pe file signature why are you disassembling pe header
    – blabb
    Aug 12 at 10:01
  • Use rebase in ida to synchronise windbg with ida this has to be done per session if ASLR is active
    – blabb
    Aug 12 at 10:05
  • In your example, you're forgetting to add the offset that you calculated (0x202AB4). I.e., you're saying one thing and doing another. Once you have the offset, though, you can add it to the module name in windbag: ? tcpip.sys+$offset
    – Ali Rizvi-Santiago
    Aug 12 at 16:28
  • 1
    IDAPython (7.x): idaapi.inf_get_min_ea() - idc.get_screen_ea() IDAPython (6.x): idaapi.get_inf_structure().minEA - idc.ScreenEA()
    – Ali Rizvi-Santiago
    Aug 14 at 19:20

2 Answers 2

Reset to default
1

So the offset should be 202AB4

no

.data:00000001C0203AB4 dword_1C0203AB4 dd 0FFFFh

subtract ImageBase from this not start of .text
to get imagebase you scroll to the top and read the summary
use idapython get_imagebase
or go to edit->rebase and copy the imagebase that shows up there by default

in your case it would be 203AB4

and in windbg you are disassembling at moduleBase or ImageBase instead of Disassembling at start of .text so the functions do not match

0: kd> u tcpip+0x1008 l1
tcpip!TcpNotifyBacklogChangeSend:
fffff800`883f1008 4053            push    rbx
0: kd>

btw the offset 3ab4 also appears to be wrong it seems to be at 3a74 (may be different versions of tcpip.sys )

data:00000001C0203A74 dword_1C0203A74 dd 0FFFFh               ; DATA XREF: CTcpQueryTimeStamp+6↑r
.data:00000001C0203A74                                         ; CTcpQueryTimeStamp+51↑w ...
Improve this answer
0

I just followed the guide from blabb. In my IDA, it's Edit->Segments->Rebase program. The image base is 0x1C0000000 instead of 1C0001000. The PE has some other headers before the section headers(.text,.data etc) to provide other essential information for the OS to manage files.

The command Ali gave me was not working due to spec. The below command should work but it didn't subtract the real image base and the output was the same as the wrong one.

ida_ida.inf_get_min_ea()-idc.get_screen_ea()
Improve this answer
1
  • yea, blabb's answer is right. especially as i misunderstood the question to begin with, saw his correct answer posted, and then removed before you even got a chance to see it until it was updated a month later. inf_get_min_ea returns the lowest loaded address in the database, so it depends on how it's loaded, whereas get_imagebase returns it correctly all the time. i highly recommend using the ida-minsc plugin, as the function you'd use to return the offset for an address in the database would be database.offset() which is significantly easier to remember.
    – Ali Rizvi-Santiago
    Sep 7 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.