🚀 go-pugleaf

IIRC there is some mention in bordebug.h . how to calculate what you need.

snip from borgebug.h
   You can go from segment:offset address in the debug info
    to actual physical address during debugging in the
    following way:

    - find the base address of the loaded executable
    - find the segment and offset of the piece of debug
      info you are interested in.  This can be a procedure,
      thunk, data, etc.
    - crack the pe-header, and find out the base offset
      of the segment you are interested in
    - Now add the base address of the executable, the
      base offset of the segment, and the offset, and
      you will have the physical address where the item
      you are interested in is loaded at runtime.


"Eyyub Volkan �ektimur" wrote in message
> Firstly thank for interest;
>
> I've cracked PE-Header and get the sections from struct. In section struct
> there are start address of sections and end address'. So we can find that
> which segment contains the address. I ensure that the address is on 1.
> segment (also looked and confirmed by .map file) and the 1. segment begins
> from 0x1000 offset. so i subtract it (0x4980-0x1000=0x3980) from the
> segment's offset. but still this address is meaningless.
>
> when i cracked .tds file via bordebug.dll, called procedure
(DoSomething())
> is in  one of the section that starts from (about 0xD400) (i'm not sure
> about the address because i'm at home now, but something like that) and
the
> sections offset is bigger than 0x3980 . also there is an function offset
> (about 0xD80) .
>
> Anyway i couldn't yet understand how can we get symbol name (proc.name)
from
> .tds file by getting address via StackWalk. BorDebug.dll publishes all the
> needed functions but i couldn't find the way...
>
>
>