Search code examples
hexoffsetwindbgida

How to calculate the address of a function using the base address of ntoskrnl.exe

This is what I have determined thus far on a test machine:

  1. base address of ntoskrnl.exe is 0xFFFFF802C8803000
  2. using IDA the address of the imagebase is 0x0000000140000000
  3. using IDA the address of the function is 0x00000001401422D0
  4. the offset (3 subtract 2) is determined to be 0x1422d0
  5. the function address is determined to be 0xFFFFF802C8803000 + 0x1422d0 = 0xfffff802c89452d0
  6. Windbg says the address is 0xfffff802c89454d0

Is the above calculations correct ? Please tell me what I'm doing wrong ?

Solution

  • Found the solution thanks to Neitsa. I was working with two different versions of ntoskrnl.exe one version for Windbg and the other version with IDA Free.