Linux IDA Offsets

I'm trying to learn how to update offsets myself and I've done countless amounts of searching trying to find out how to do this but I've being unable to find anything for what I particularly need, which could be down to me searching the wrong thing or whatever so my apologies if this has been covered already.

Could someone guide me on how I'd find the offset for "+alt1" as an example using IDA on Linux?

I have the signature here that I'm working from:

Code:

m_iAlt1:    (C1 E0 11 C1 F8 1F 83 E8 03 84 D2 74 07 21 C8 A3 ?? ?? ?? ?? 8B 0D) + 0x10

Any help would be greatly appreciated!

I can't show you how to find the offset, though i can tell you how to.

You already have the pattern.

Open up IDA, hit Search->Sequence of bytes->Paste Signature in there->Search->Go 16 bytes further->You got your offset.

Originally Posted by WasserEsser

Wow, thanks a lot!

I was going 10 bytes further as I thought that's what the 0x10 meant.

Could you kindly elaborate on what that means exactly, if possible? Just so I fully understand.

Originally Posted by BlurDog

Wow, thanks a lot!

I was going 10 bytes further as I thought that's what the 0x10 meant.

Could you kindly elaborate on what that means exactly, if possible? Just so I fully understand.

0x10 is a hexadecimal number. 0x10 is equivalent to 16 in decimal.

The address of where the pattern starts + 16 bytes is the start of your offset. The next 4 bytes are your offset.

/Solved & closed.

Linux IDA Offsets

Post a Reply

Similar Threads

Tags for this Thread