Show Virtual Address (PE Viewer/Editor)

Wishlists for new functionality and features.
Post Reply
vincentlu
Posts: 11
Joined: 18 Sep 2009 11:33

Show Virtual Address (PE Viewer/Editor)

Post by vincentlu » 18 Sep 2009 12:06

Hi Maël,

Can you show the Virtual Address(VA) on the bottom ??

For example :

Original :
Offset: 6F2494 *Modified* Overwrite

Change to :
Offset: 6F2494 VA:00AF2494 *Modified* Overwrite

Thank you
Vincent

Maël
Site Admin
Posts: 1105
Joined: 12 Mar 2005 14:15

Re: Show Virtual Address

Post by Maël » 18 Sep 2009 17:42

I think you are talking about the RAM editor?
But there the Offset (cursor position) is the same as the virtual address.
Or do you mean something different?

vincentlu
Posts: 11
Joined: 18 Sep 2009 11:33

Re: Show Virtual Address

Post by vincentlu » 19 Sep 2009 05:06

Hi Maël,

For example:

I have a file by OllyDbg below,
004C1F78 > $ 55 PUSH EBP
004C1F79 . 8BEC MOV EBP,ESP
004C1F7B . 83C4 F0 ADD ESP,-10
004C1F7E . 53 PUSH EBX
004C1F7F . B8 001C4C00 MOV EAX,2.004C1C00
004C1F84 . E8 9743F4FF CALL 2.00406320

If HxD can show(cursor position):

In FILE editor mode:
Offset: C1F78 VA:004C1F78

In RAM editor mode:
VA:004C1F78 FileOffset: C1F78

Thank you
Vincent

Maël
Site Admin
Posts: 1105
Joined: 12 Mar 2005 14:15

Re: Show Virtual Address

Post by Maël » 29 Sep 2009 02:22

That would be more around a PE file viewer. Might be an option for a plugin or a structure view in the future.

Post Reply