Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Conversation

@Windows81
Copy link

@Windows81 Windows81 commented Sep 26, 2025

This function should perform the inverse of what mod.offset does: to get the virtual address from a file offset.

I added it because I'm trying to get the start of the .data region of an EXE.

Specifically, I am trying to use the find command to find a quick way to reconstruct global data that gets initialised by _initterm upon runtime (hope that doesn't raise too many questions).

However, there is no way to convert a file offset (in variable form) to a virtual offset.

The following should print out the file offset.

find :0,"2e 64 61 74 61"; dword:[($result+14)]

However, the following is invalid in the command syntax:

:#(dword:[($result+14)])

@Windows81
Copy link
Author

@mrexodia: please confirm.

@mrexodia
Copy link
Member

In theory :#(dword:[($result+14)]) should work, so I think that bug should be fixed. Will think about whether I want to merge this functionality, but it seems alright to me!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.