skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-address-space

Converts addresses across PIE, ASLR, RVA, VA, and firmware loader offsets for reverse engineering.

64|9|Updated Aug 17, 2026
Search Tags:#reverse engineering#gdb#elf#pie#address translation#aslr#rva
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-address-space-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-address-space
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-address-space
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-address-space-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reverse engineers constantly hit the problem of addresses not matching: the address shown in Ghidra differs from the runtime address in gdb, which differs again from what angr or frida reports. This Skill provides a unified procedure for translating between file offsets, link-time addresses, and runtime addresses so breakpoints, symbol lookups, and cross-tool comparisons actually line up. ## Core Features & Use Cases - Static base and RVA/VA conversion: Determine the link-time base from ELF program headers (readelf) and convert between file offsets, RVAs, and virtual addresses per segment. - Runtime base resolution under PIE/ASLR: Compute the load bias dynamically from /proc/pid/maps, gdb info proc mappings, or frida module base APIs, handling separate-code layout differences. - Cross-tool address alignment: Reconcile addresses between Ghidra, angr (mapped_base/rebase), gdb, and frida by anchoring everything to the runtime base. - Firmware loader offset: Reverse-engineer the delta between a firmware image's link address and its actual load address from boot code. - Use Case: You set a breakpoint in gdb at the address Ghidra shows for a function in a PIE binary and it never hits. Use this Skill to compute the load bias from the process maps and relocate the breakpoint correctly. ## Quick Start Ask the AI to compute the runtime address of a function at link-time offset 0x1234 in a PIE binary given its process ID, using the address-space conversion procedure.

Frequently Asked Questions about re-address-space

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the runtime base address of a PIE binary?▼

Read the first mapping of the process from /proc/<pid>/maps or run gdb with info proc mappings. The load bias is the runtime mapping start minus the lowest PT_LOAD p_vaddr, and it changes every run under ASLR so it must be computed dynamically.

How to convert between RVA, VA, and file offset in ELF files?▼

Use readelf -l to get the LOAD segments, then apply VA = p_vaddr + (file_offset - p_offset) within the matching segment. ELF has no single ImageBase like PE, so always convert per segment rather than linearly across the whole file.

Why does my gdb breakpoint at the Ghidra address never hit?▼

Ghidra shows link-time addresses while gdb uses runtime addresses, and under PIE/ASLR they differ by the load bias. Add the bias (runtime base minus link base) to the Ghidra address before setting the breakpoint.

How do I align angr addresses with runtime addresses?▼

Check proj.loader.main_object.mapped_base for angr's current base and call rebase on the backend object to change it. Anchor all tools to the runtime base from the live process so addresses compare consistently.

When should I not use this address conversion procedure?▼

Skip it when you only need to read ELF headers or section tables, which belongs to format parsing, or when you need detailed runtime memory layout inspection, which belongs to memory dumping or debugger workflows.

Related Skills

Explore More Software Engineering Skills→
ZurybrZurybr

extract-elf

Extract memory values and segment information from ELF binary files.

Community
Advanced
2389-research2389-research
90

binary-re:dynamic-analysis

Execute and trace binaries with QEMU, GDB, and Frida.

Official
Advanced
vzcovzco
15

map-struct

Map C++ object memory layouts from addresses using RTTI and hex dumps.

Official
Intermediate
awfixers-stuffawfixers-stuff

elf-inspection

Inspect ELF binaries for dependencies, symbols, sections, and debug info.

Official
Intermediate