Page 1 of 1
Show Virtual Address (PE Viewer/Editor)
Posted: 18 Sep 2009 12:06
by vincentlu
Hi Maël,
Can you show the Virtual Address(VA) on the bottom ??
For example :
Original :
Offset: 6F2494 *Modified* Overwrite
Change to :
Offset: 6F2494 VA:00AF2494 *Modified* Overwrite
Thank you
Vincent
Re: Show Virtual Address
Posted: 18 Sep 2009 17:42
by Maël
I think you are talking about the RAM editor?
But there the Offset (cursor position) is the same as the virtual address.
Or do you mean something different?
Re: Show Virtual Address
Posted: 19 Sep 2009 05:06
by vincentlu
Hi Maël,
For example:
I have a file by OllyDbg below,
004C1F78 > $ 55 PUSH EBP
004C1F79 . 8BEC MOV EBP,ESP
004C1F7B . 83C4 F0 ADD ESP,-10
004C1F7E . 53 PUSH EBX
004C1F7F . B8 001C4C00 MOV EAX,2.004C1C00
004C1F84 . E8 9743F4FF CALL 2.00406320
If HxD can show(cursor position):
In FILE editor mode:
Offset: C1F78 VA:004C1F78
In RAM editor mode:
VA:004C1F78 FileOffset: C1F78
Thank you
Vincent
Re: Show Virtual Address
Posted: 29 Sep 2009 02:22
by Maël
That would be more around a PE file viewer. Might be an option for a plugin or a structure view in the future.