|
I am analyzing a Windows PE file and want to obtain the file offset. I have already adjusted the address display mode to "from file start" in Binary Ninja. However, I noticed that the addresses shown in Binary Ninja are consistently 0xC00 larger than the actual file offsets. After investigating, I found that the .text section does not immediately follow the header; instead, it starts at 0x1000, as shown in the figure. 
How can I obtain the actual file offsets without manually subtracting 0xC00 each time? Is there a way for the software to handle this automatically? Thank you! |
Replies: 2 comments 1 reply
|
Toggling "From File Start" actually does NOT show the raw file offsets (despite the confusing name). It shows the value of current address minus the start of the binary view. In other words, the current address is IMO the name of the menu entry should probably be renamed to something like "From View Start", and another option, e.g., "From Raw File Start" should be added which does what you wanted |
|
thanks, hope it will be implemented in the coming release. |
Toggling "From File Start" actually does NOT show the raw file offsets (despite the confusing name). It shows the value of current address minus the start of the binary view. In other words, the current address is
0x140001000, and the start of the binary view is0x140000000. So it shows0x1000.IMO the name of the menu entry should probably be renamed to something like "From View Start", and another option, e.g., "From Raw File Start" should be added which does what you wanted