Igor’s Tip of the Week #168: Rebasing

When you load a file into IDA,  whether a standard executable format (e.g. PE, ELF, Macho-O), or a raw binary, IDA assigns a particular address range to the data loaded from it, either from the file’s metadata or user’s input (in case of binary file). The lowest address from those occupied by the file is commonly called imagebase and you can usually see it in the file comment at the start of the disassembly listing:

There may be situations …

address binary case data elf file ida input malware analysis metadata standard week