Get absolute memory addresses instead of relative offsets from hexdump
2
votes
2
answers
4345
views
I'm trying to get a better understanding of memory addresses. I've just begun examining binaries with
hexdump.
Ex output:
0000000 cf fa ed fe 07 00 00 01 03 00 00 80 02 00 00 00
0000010 0e 00 00 00 b0 03 00 00 85 00 00 00 00 00 00 00
0000020 19 00 00 00 48 00 00 00 5f 5f 50 41 47 45 5a 45
0000030 52 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000040 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
My understanding is that the codes I see at the beginning of each line are relative memory addresses expressed as an offset from a base address. I'm trying to figure out if there's a way I can get the absolute addresses instead.
I'd be happy with a solution that either shows me those addresses explicitly, or simply helps me figure out what the base address is that they are relative to, so I can calculate them myself.
Asked by David Kennell
(185 rep)
Apr 26, 2019, 02:49 PM
Last activity: Mar 24, 2021, 06:39 PM
Last activity: Mar 24, 2021, 06:39 PM