Can someone explain to me how to calculate an offsets relative position?

w0g · Oct 5, 2014

Trying to replace a value in IDA Pro using hex as I want to replace a tab with another tab. But I need to know how to calculate the offsets relative position so that the value I replace matches the value I copied.

Now lets change one of the referenced tabs to the seventh tab. My hidden tab is at address 0x18007F490 (I know this because it's the only one not referenced in the disassembled function we edited), so lets change the line of code "lea rax, 0x18007FA00" to reference this tab.

The hex values for this line are 48 8D 05 55 E9 07 00. The first three bytes are the load affective address into rax part, and the last four bytes are the offset of the address. This is a relative address based off of the current instructions address. And it's stored in little endian. So if your good with math you can determine the new values with a calculator, or you can just changes some values and see if they'll work right by seeing what IDA Pro displays. Here's what mine looked like when I was finished:
Click to expand...

Can someone explain to me how to calculate an offsets relative position?

w0g MDL Novice

Attached Files:

32.png