Search code examples
c++debuggingmemoryreverse-engineeringcheat-engine

Is the memory i see on IDA or dbg or olly the same as i have loaded live on RAM?


So if I load an EXE on IDA there are offsets and memory addresses on different locations.

When I start that EXE and see in cheat engine after a variable is it the same address as in IDA loaded? Or ghidra for example?


Solution

  • The addresses you see in static analysis (IDA) are relative to the preferred base address which is in the PE header. If the image is not loaded at it's preferred address then it won't match the static address you see. However, you can just calculate the relative virtual address in dynamic memory (address - base_address) and then add it to the preferred base address to get what you see in IDA. This is assuming that the file isn't packed of course, in which case static analysis can appear to be just random data until sections are unpacked in memory at the entry point.