This is a very silly question, but surprisingly I've had a problem with this today. In a hex editor, I've found an offset and I wanted to take a look at that code in a disassembler. In the hex-editor, the offset is EBE75, and it looks like this:
Obviously a CALL, I wanted to find it in IDA/Olly and take a look. This is, however, where I wasn't sure how to translate that to an offset that IDA/Olly could understand. Do I add the imagebase, or maybe the offset of the .text section? I've managed to find the code using IDA's hexscan, and it's located at address
The difference between these addresses is
4ECA75 - EBE75 = 400C00. This is quite surprising to me, where did that number come from? How is this related to the .exe's layout?