1

In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the same. My approach is to calculate the offset and add it to the base memory.

start
.text:00000001C0001000 _text           segment para public 'CODE' use64
.text:00000001C0001000                 assume cs:_text
.text:00000001C0001000                 ;org 1C0001000h
.text:00000001C0001000                 assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
.text:00000001C0001000                 db 8 dup(0CCh)
.text:00000001C0001008
.text:00000001C0001008 ; =============== S U B R O U T I N E =======================================
.text:00000001C0001008
.text:00000001C0001008
.text:00000001C0001008 ; __int64 __fastcall TcpNotifyBacklogChangeSend(PKSPIN_LOCK SpinLock)
.text:00000001C0001008 TcpNotifyBacklogChangeSend proc near    ; CODE XREF: TcpNotifyTcbDelay+337↓p
.text:00000001C0001008                                         ; DATA XREF: .pdata:ExceptionDir↓o
...
...
.data:00000001C0203AB4 dword_1C0203AB4 dd 0FFFFh               ; DATA XREF: CTcpQueryTimeStamp+6↑r
.data:00000001C0203AB4                                         ; CTcpQueryTimeStamp+51↑w ...
.data:00000001C0203AB8 icmpPingLowWaterMark dd 1F4h            ; DATA XREF: IppInspectLocalDatagramsIn+5FED5↑r
.data:00000001C0203ABC EQoSpPolicyAppMarkingSetting dd 0FFFFFFFEh
.data:00000001C0203ABC                                         ; DATA XREF: EQoSUpdateAppMarkingSetting+A↑r
.data:00000001C0203ABC                                         ; EQoSProcessGlobalSettings+35↓r ...
.data:00000001C0203AC0 EQoSpPolicyTcpAutoTuningSetting dd 0FFFFFFFFh

So the offset should be 202AB4

kd> lm m tcpip

start     end      module name
fffff803'6b750000 fffff803'6ba6a000  tcpip (pdb symbols)  

However, the value is not what I want(0xFFFF) and the initial address function in IDA and windbg is not the same

kd> u fffff8036b750000
tcpip! WFPDatagramDataShimV4 <PERF> (tcpip+0x0):
fffff803`6b750000 4d5a      pop   r10

What's the correct approach to calculate the address value dword_1C0203AB4?

7
  • How 2ab4 ? .text is not start of module
    – blabb
    Commented Aug 12, 2023 at 9:59
  • 4d5a is MZ the pe file signature why are you disassembling pe header
    – blabb
    Commented Aug 12, 2023 at 10:01
  • Use rebase in ida to synchronise windbg with ida this has to be done per session if ASLR is active
    – blabb
    Commented Aug 12, 2023 at 10:05
  • @AliRizvi-Santiago. No he serms to be subtracting the start of .text which is typically 0x1000 greater than image so his value is 0x1000 less it should be xxx3ab4 and in windbg he seems to disassembling. At image base and saying it doesnt match the function which is 0x1000 bytes ahead in start of .text section
    – blabb
    Commented Aug 12, 2023 at 17:23
  • i thought i would wait for feedback but the op seems to have jumped to another question and left this dangling so just posted the comment contents as answer
    – blabb
    Commented Aug 14, 2023 at 22:01

2 Answers 2

1

So the offset should be 202AB4

no

.data:00000001C0203AB4 dword_1C0203AB4 dd 0FFFFh   

subtract ImageBase from this not start of .text
to get imagebase you scroll to the top and read the summary
use idapython get_imagebase
or go to edit->rebase and copy the imagebase that shows up there by default

in your case it would be 203AB4

and in windbg you are disassembling at moduleBase or ImageBase instead of Disassembling at start of .text so the functions do not match

0: kd> u tcpip+0x1008 l1
tcpip!TcpNotifyBacklogChangeSend:
fffff800`883f1008 4053            push    rbx
0: kd>

btw the offset 3ab4 also appears to be wrong it seems to be at 3a74 (may be different versions of tcpip.sys )

data:00000001C0203A74 dword_1C0203A74 dd 0FFFFh               ; DATA XREF: CTcpQueryTimeStamp+6↑r
.data:00000001C0203A74                                         ; CTcpQueryTimeStamp+51↑w ...
0

I just followed the guide from blabb. In my IDA, it's Edit->Segments->Rebase program. The image base is 0x1C0000000 instead of 1C0001000. The PE has some other headers before the section headers(.text,.data etc) to provide other essential information for the OS to manage files.

The command Ali gave me was not working due to spec. The below command should work but it didn't subtract the real image base and the output was the same as the wrong one.

ida_ida.inf_get_min_ea()-idc.get_screen_ea()
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.