5

I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a virtual address?

sasho648
  • 421
  • 5
  • 11
  • See http://reverseengineering.stackexchange.com/questions/8050/raw-offsets-to-disassembler-offsets – Jason Geffner Feb 12 '15 at 15:12
  • Can you give me some more practical advice? I know the theory but for god sake - I can't always do this complex calculations! – sasho648 Feb 12 '15 at 16:06

2 Answers2

9

At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue).

(Underlines by me, not by Ida).

enter image description here

Guntram Blohm
  • 12,950
  • 2
  • 22
  • 32
3

To find it using IDAPython:

ida_loader.get_fileregion_offset(ea)

where "ea" is your virtual offset like 0x400000.

Paweł Łukasik
  • 4,912
  • 1
  • 14
  • 27
Cih2001
  • 66
  • 1
  • 1
    For anyone interested, there is a reverse function, too: get_fileregion_ea(offset), where offset is a long. More info about the two functions here: https://www.hex-rays.com/products/ida/support/idapython_docs/ida_loader-module.html#get_fileregion_ea – Illya Moskvin Nov 27 '20 at 01:15