|
The address seen in IDA is the VA (virtual address), the address you need in WinHex is the File Offset. Generally,
Offset = VA - Image Base (usually 0x400000) - (code section VOffset - code section ROffset).
PE editors like LordPE and PE Tools are useful in this regard, and and will tell you the Offset for a given VA (or vice-versa) for any given file. In LordPE and PE Tools specifically, click on FLC to get to this.
Last edited by Satyric0n; 02-11-2004 at 02:41.
|