How to get the memory base of .rdata?

0

I am new to assembly language and try to get the memory base of the .rdata section because I would like to compare a string from there with a current string that's on the stack. I am using x64dbg.

Example: At a specific call I see the (relative) memory address from some data that is stored in .rdata, let's say it is 0x001C0000 and .rdata starts at 0x001A0000 and ends at 0x001F0000. In x64dbg I can get the .rdata memory base by typing mem.base(0x001C0000) which returns 0x001A0000 but how can I do it in x86 assembly language? What I am trying to do is access data from .rdata but I don't know the offset from the memory base. How can I do that?

debugging
assembly
memory
x86
ida
asked on Stack Overflow Aug 12, 2018 by Woods

1 Answer

0

Use "dumpbin.exe". Here is how: suppose your file is "foo.exe", do:

dumpbin.exe /all foo.exe >foo.txt

Then, open foo.txt and look for "SECTION HEADER #1" and check the name (for example ".text"). Then, look for "SECTION HEADER #2", #3, etc..

One of these will be named ".rdata". Just under the name, you have the field "virtual address". That's what you want.

answered on Stack Overflow Mar 30, 2021 by Pizza

User contributions licensed under CC BY-SA 3.0