Last updated
Last updated
Rebasing ensures that code in reverse engineering tools like Ghidra matches its actual runtime memory layout. This prevents misaligned addresses, broken references, and incorrect analysis results. It enables accurate disassembly, direct correlation with debugger or crash log addresses, and is crucial for tasks like exploit development and malware analysis. Rebasing also avoids redundant work if the correct base address is identified later.
Accurate Disassembly: without the right base address, all code and data references will be misaligned. This leads to broken function pointers, incorrect jump/call targets, and misleading cross-references.
Match Runtime Addresses: analysis of memory dump, debugger output, or logs from a system (e.g. 0x401234 seen in a crash trace), enables the ability to correlate those addresses to functions in Ghidra without manual translation. If Ghidra is loaded at a wrong base, an address of 0x401234 might appear as something like 0x00401234 - 0x1000 = 0x00400234 which requires constant manual math calculations.
Exploit Development / Reverse Engineering: Exploit writers often need to reference exact instruction addresses (e.g., ROP gadgets). Malware analysts rely on real virtual addresses when correlating instructions to logs, behaviors, or indicators of compromise (IOCs).
Avoids Rework: analyzing a binary at the wrong base, and later get the correct base (from a debugger trace), the analyst might have to either redo the work or rebase the whole analysis.
Ghidra must be set to the same "base address" found by WinDBG. When the interesting code parts are found and identified, no address translation will be required, as the addresses in WinDBG and Ghidra will match.