Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Q&A for work
Connect and share knowledge within a single location that is structured and easy to search.
I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a virtual address?
At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue).
(Underlines by me, not by Ida).
To find it using IDAPython:
where "ea" is your virtual offset like 0x400000.
Required, but never shown