This should be a simple question: I know that VA = RVA + imagebase for a PE, now I'm trying to locate in a disassembler a string and happens to be located at 0042720E in the .text section.
The imagebase is 400000 and 2720E is the RVA, it is okay till now.
But why when I load the exe in a debugger the memory where the instruction is mapped is 0140720E ?
0140720E (what I see in ram) and 0042720E (the VA) differs by FE0000, why is that? Am I missing something?
There are really only two possibilities: a reallocation occured or you got the RVA wrong. The more likely is its a reallocation, especially if your running on windows vista or windows 7 due to ASLR. Depending on how you attached and what debugger your using, its possible to get the debugger to adjust the reported addresses to match the base section load addresses specified in the PE, ollydbg is one of these (you must start the app through ollydbg, same for dlls)