Hi Maël,
Can you show the Virtual Address(VA) on the bottom ??
For example :
Original :
Offset: 6F2494 *Modified* Overwrite
Change to :
Offset: 6F2494 VA:00AF2494 *Modified* Overwrite
Thank you
Vincent
Show Virtual Address (PE Viewer/Editor)
Re: Show Virtual Address
I think you are talking about the RAM editor?
But there the Offset (cursor position) is the same as the virtual address.
Or do you mean something different?
But there the Offset (cursor position) is the same as the virtual address.
Or do you mean something different?
Re: Show Virtual Address
Hi Maël,
For example:
I have a file by OllyDbg below,
004C1F78 > $ 55 PUSH EBP
004C1F79 . 8BEC MOV EBP,ESP
004C1F7B . 83C4 F0 ADD ESP,-10
004C1F7E . 53 PUSH EBX
004C1F7F . B8 001C4C00 MOV EAX,2.004C1C00
004C1F84 . E8 9743F4FF CALL 2.00406320
If HxD can show(cursor position):
In FILE editor mode:
Offset: C1F78 VA:004C1F78
In RAM editor mode:
VA:004C1F78 FileOffset: C1F78
Thank you
Vincent
For example:
I have a file by OllyDbg below,
004C1F78 > $ 55 PUSH EBP
004C1F79 . 8BEC MOV EBP,ESP
004C1F7B . 83C4 F0 ADD ESP,-10
004C1F7E . 53 PUSH EBX
004C1F7F . B8 001C4C00 MOV EAX,2.004C1C00
004C1F84 . E8 9743F4FF CALL 2.00406320
If HxD can show(cursor position):
In FILE editor mode:
Offset: C1F78 VA:004C1F78
In RAM editor mode:
VA:004C1F78 FileOffset: C1F78
Thank you
Vincent
Re: Show Virtual Address
That would be more around a PE file viewer. Might be an option for a plugin or a structure view in the future.