Home/ Questions/Q 9128329
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T07:29:21+00:00

1) In dumpbin output of a dll, I see below attribute virtual address under

  • 0

1)
In dumpbin output of a dll, I see below attribute “virtual address” under code section

SECTION HEADER #1

.text name

100C virtual size
1000 virtual address (1C001000 to 1C00200B)
1200 size of raw data
 400 file pointer to raw data (00000400 to 000015FF)
   0 file pointer to relocation table
   0 file pointer to line numbers
   0 number of relocations
   0 number of line numbers

60000020 flags

      Code

     Execute Read

scn2

scn1

2)
Screenshot Scn2.png(attached) is left hand side part of scn1.png(attached).

My question is,
Is the above attribute virtual address range(1C001000 to 1C00200B) nothing but offset(Effective address) in red circle as per screenshot(attached)?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Normally, technically (as for as the Portable Executable specification is concerned), the Virtual Address attribute is the offset of the Section from the ImageBase where the Image wll be loaded (this is also an point which depends on ASLR) in MEMORY.

    Some tools, like dumpin, automatically compute the result and show the Virtual Address resulting from the addition to the Image Base. In this case, yes you’re right, “the range is nothing but offset(Effective address)”!

    • 0