Some questions about based / rebased offsets

[MadCoder]

Hi guys! I was reading this forum for a while, but still i have to ask some questions about offsets.

I have PC with Windows XP SP 3 installed, so it must mean for me to use not rebased offsets, right?

And then, should I increment offsets by "wowbase" or not?

[l0l1dk]

Versions of Windows earlier than Vista do not support ASLR, so you won't need to get the base address every time. WoW will always be loaded at 0x400000, so you can use the addresses in the info dump thread without having to change them, if they aren't rebased. Addresses from IDA will be based at 0x400000 also, so you won't need to change them.

[MadCoder]

Thanks very much for answer

[MyNewName]

Versions of Windows earlier than Vista do not support ASLR, so you won't need to get the base address every time. WoW will always be loaded at 0x400000, so you can use the addresses in the info dump thread without having to change them, if they aren't rebased. Addresses from IDA will be based at 0x400000 also, so you won't need to change them.

I have a quick question if you wouldn't mind answering a noob question. Which I very much am. If i was going to rebase a number starting 0xD1????. What would my outcome be. I thought... BIG MISTAKE that it would come out as 0x91????. Is this just retarded?

[yossarian87]

If the offset is 0xD10000 unrebased, then the rebased offset is indeed 0x910000, but you have to add to that the base address of wow.exe to find the correct address. The address you really want is (wow.exe + 0x910000).