I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a virtual address?
2
- See reverseengineering.stackexchange.com/questions/8050/…Jason Geffner– Jason Geffner2015-02-12 15:12:00 +00:00Commented Feb 12, 2015 at 15:12
- Can you give me some more practical advice? I know the theory but for god sake - I can't always do this complex calculations!sasho648– sasho6482015-02-12 16:06:48 +00:00Commented Feb 12, 2015 at 16:06
Add a comment |
2 Answers
At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue).
(Underlines by me, not by Ida).
- 1Do you also know how can I copy it into clipboard?sasho648– sasho6482015-02-13 21:32:49 +00:00Commented Feb 13, 2015 at 21:32
- 1What if it gives me this?c00000fd– c00000fd2019-04-06 23:00:55 +00:00Commented Apr 6, 2019 at 23:00
To find it using IDAPython:
ida_loader.get_fileregion_offset(ea) where "ea" is your virtual offset like 0x400000.
- 1For anyone interested, there is a reverse function, too:
get_fileregion_ea(offset), where offset is a long. More info about the two functions here: hex-rays.com/products/ida/support/idapython_docs/…Illya Moskvin– Illya Moskvin2020-11-27 01:15:53 +00:00Commented Nov 27, 2020 at 1:15