I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a virtual address?
2
-
See reverseengineering.stackexchange.com/questions/8050/…– Jason GeffnerCommented Feb 12, 2015 at 15:12
-
Can you give me some more practical advice? I know the theory but for god sake - I can't always do this complex calculations!– sasho648Commented Feb 12, 2015 at 16:06
Add a comment
|
2 Answers
At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue).
(Underlines by me, not by Ida).
answered Feb 12, 2015 at 16:22
-
1
-
1
To find it using IDAPython:
ida_loader.get_fileregion_offset(ea)
where "ea" is your virtual offset like 0x400000.
-
1For anyone interested, there is a reverse function, too:
get_fileregion_ea(offset), where offset is a long. More info about the two functions here: hex-rays.com/products/ida/support/idapython_docs/… Commented Nov 27, 2020 at 1:15