0

I've found an array inside an executable which I want to further investigate at runtime - I want to know what and from where this array is getting accessed at runtime.

Using IDA I have this block of bytes:

.rdata:00D44170  1C 3C D4 00 80 E6 90 00  5C 41 D4 00 00 E7 90 00  <È.ǵÉ.\AÈ..þÉ.
.rdata:00D44180  4C 41 D4 00 50 E7 90 00  44 41 D4 00 B0 E8 90 00  LAÈ.PþÉ.DAÈ.¦ÞÉ.
.rdata:00D44190  3C 41 D4 00 00 E9 90 00  34 41 D4 00 10 EB 90 00  <AÈ..ÚÉ.4AÈ.ÙÉ.
.rdata:00D441A0  2C 41 D4 00 90 EB 90 00  24 41 D4 00 50 EB 90 00  ,AÈ.ÉÙÉ.$AÈ.PÙÉ.
.rdata:00D441B0  0C 8B E0 00 80 E4 90 00  18 41 D4 00 50 E5 90 00  ïÓ.ÇõÉ.AÈ.PÕÉ.
.rdata:00D441C0  EC 8A E0 00 40 F6 90 00  9C C8 E4 00 D0 EA 90 00  ýèÓ.@÷É.£+õ.ðÛÉ.
.rdata:00D441D0  10 41 D4 00 70 ED 90 00  08 41 D4 00 C0 ED 90 00  AÈ.pÝÉ.AÈ.+ÝÉ.
.rdata:00D441E0  FC 40 D4 00 C0 E9 90 00  F4 40 D4 00 F0 E9 90 00  ³@È.+ÚÉ.¶@È.­ÚÉ.
.rdata:00D441F0  EC 40 D4 00 20 EA 90 00  E4 40 D4 00 10 EE 90 00  ý@È. ÛÉ.õ@È.¯É.
.rdata:00D44200  D4 40 D4 00 A0 EA 90 00  CC 40 D4 00 60 EA 90 00  È@È.áÛÉ.¦@È.`ÛÉ.
.rdata:00D44210  C0 40 D4 00 E0 EC 90 00  B8 40 D4 00 20 ED 90 00  +@È.ÓýÉ.©@È. ÝÉ.
.rdata:00D44220  AC 40 D4 00 80 EC 90 00  A4 40 D4 00 50 F0 90 00  ¼@È.ÇýÉ.ñ@È.P­É.
.rdata:00D44230  00 00 00 00 00 00 00 00                           ........

The question is if I can calculate the actual virtual address of this as the process is running in order to use other tools like Cheat Engine to watch this particular area in virtual memory for me.

Stefan Falk
  • 23,898
  • 50
  • 191
  • 378
  • If this is from an EXE then what you see on the left should indeed be the actual virtual address where this data is mapped. Have you tried to verify at run-time? – 500 - Internal Server Error Dec 03 '16 at 16:19
  • @500-InternalServerError It turns out that these are *almost* the correct values. They are 0x1000 bytes (4kb). IDA also does not "visualize" the same area of code once the debugger is attached to the process. If I just loadthe .exe file to IDA then the data gets much better labelled etc. In the debugger the data is harder to read but in combination with Cheat Engine I realized that the addresses are in fact the same! Thank you! – Stefan Falk Dec 03 '16 at 17:04

0 Answers0