How Convert Offset To VA

[Bl@ck Virus]

hello all

how can I convert Some DLL Offset address to VA ?

Quote

i want to convert this address to VA 

i attach DLL file too

can i do it directly by x64dbg ? 

tnx in advance 

am.dll

[crystalboy]

To convert file offset to VA you should take a look at PE section table and find what of the section contain the raw offset that you need.

When you find the section there is a formula to calculate it:

your_offset - raw_offset_of_section_that_contain_your_offset + virtual_address_of_section_that_contain_your_offset + IMAGE_BASE = VA

Hope it helps

regards

[Bl@ck Virus]

2 minutes ago, crystalboy said:

To convert file offset to VA you should take a look at PE section table and find what of the section contain the raw offset that you need.

When you find the section there is a formula to calculate it:

your_offset - raw_offset_of_section_that_contain_your_offset + virtual_address_of_section_that_contain_your_offset + IMAGE_BASE = VA

Hope it helps

regards

tnx for you answer 

but is it any application to do it automatically ?

 

[crystalboy]

Yes there is:

PETools (Tools -> PE Editor (select your dll) -> FLC -> Select File offset -> insert your value and press Calculate)

CFF Explorer (Drag and drop your DLL on it and press on Address Converter)

Hope it helps

Regards

 

[Bl@ck Virus]

Just now, crystalboy said:

Yes there is:

PETools (Tools -> PE Editor (select your dll) -> FLC -> Select File offset -> insert your value and press Calculate)

CFF Explorer (Drag and drop your DLL on it and press on Address Converter)

Hope it helps

Regards

 

thanks again mate

[mrexodia]

x64dbg supports it directly. Use:

kernel32.dll:#1234

To go to kernel32.dll at offset 0x1234. You can also go to a relative address like this:

x64dbg.exe:$1234

Greetings

[Bl@ck Virus]

On 3/16/2016 at 11:43 PM, Mr. eXoDia said:

x64dbg supports it directly. Use:

kernel32.dll:#1234

To go to kernel32.dll at offset 0x1234. You can also go to a relative address like this:

x64dbg.exe:$1234

Greetings

thanks for your answer Sir

but i`m newbie with x64dbg and i don`t know how I can use this " kernel32.dll:#1234 " 

do you have any video that can help me more ?

tnx agian

[mrexodia]

Use Ctrl + G (goto) and type it there

[Bl@ck Virus]

2 hours ago, Mr. eXoDia said:

Use Ctrl + G (goto) and type it there

tnx very very much

I love your Debugger....!