I am new to assembly language and try to get the memory base of the .rdata section because I would like to compare a string from there with a current string that's on the stack. I am using x64dbg.
Example: At a specific call I see the (relative) memory address from some data that is stored in .rdata, let's say it is 0x001C0000
and .rdata starts at 0x001A0000
and ends at 0x001F0000
. In x64dbg I can get the .rdata memory base by typing mem.base(0x001C0000)
which returns 0x001A0000
but how can I do it in x86 assembly language? What I am trying to do is access data from .rdata but I don't know the offset from the memory base. How can I do that?
Use "dumpbin.exe". Here is how: suppose your file is "foo.exe", do:
dumpbin.exe /all foo.exe >foo.txt
Then, open foo.txt and look for "SECTION HEADER #1" and check the name (for example ".text"). Then, look for "SECTION HEADER #2", #3, etc..
One of these will be named ".rdata". Just under the name, you have the field "virtual address". That's what you want.
User contributions licensed under CC BY-SA 3.0