{"id":29285873,"url":"https://github.com/lordmilko/rebaseext","last_synced_at":"2026-06-18T21:31:01.356Z","repository":{"id":75540880,"uuid":"487710357","full_name":"lordmilko/RebaseExt","owner":"lordmilko","description":"Debugger extension for analyzing rebased addresses","archived":false,"fork":false,"pushed_at":"2022-05-02T11:37:33.000Z","size":24,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-09-12T22:20:46.063Z","etag":null,"topics":["reverse-engineering","windbg","windbg-extension"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lordmilko.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-05-02T03:58:39.000Z","updated_at":"2025-03-11T12:03:32.000Z","dependencies_parsed_at":"2023-03-11T19:58:47.890Z","dependency_job_id":null,"html_url":"https://github.com/lordmilko/RebaseExt","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/lordmilko/RebaseExt","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lordmilko%2FRebaseExt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lordmilko%2FRebaseExt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lordmilko%2FRebaseExt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lordmilko%2FRebaseExt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lordmilko","download_url":"https://codeload.github.com/lordmilko/RebaseExt/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lordmilko%2FRebaseExt/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34508860,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-18T02:00:06.871Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["reverse-engineering","windbg","windbg-extension"],"created_at":"2025-07-05T23:12:36.271Z","updated_at":"2026-06-18T21:31:01.350Z","avatar_url":"https://github.com/lordmilko.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RebaseExt\n\nRebaseExt is a WinDbg extension that assists in cross referencing between rebased and original addresses.\n\nWhen reverse engineering a DLL, often you may be stepping through it with WinDbg while cross referencing and annotating in IDA Pro. A major challenge that can arise here however is that WinDbg shows the rebased address of a DLL, while IDA Pro shows the original raw address. You can sometimes find yourself searching for bytes in IDA to find exactly what you're looking at in WinDbg.\n\nRebaseExt solves this problem by allowing you to specify an expression that should be interpreted. Regardless of whether the expression came from WinDbg or IDA Pro, RebaseExt will figure out the meaning and show you where that address can be found both in memory and on disk.\n\n## Installation\n\nTo install RebaseExt simply copy `RebaseExt.dll` to the `winext` folder of your WinDbg installation. e.g.\n\n* `x86\\RebaseExt.dll` -\u003e `C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\winext`\n* `x64\\RebaseExt.dll` -\u003e `C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\winext`\n\nRebaseExt can then be utilized within a debugging session by typing `.load rebaseext`\n\nRebaseExt requires the [Visual C++ 2015 Runtime](https://www.microsoft.com/en-au/download/details.aspx?id=48145). You should ensure that both the x86 and x64 versions are installed, so that you can use RebaseExt in both x86 and x64 WinDbg.\n\n## Compilation\n\nRebaseExt requires the following components in order to compile\n\n* Visual Studio 2015 (newer versions may also work)\n* Windows 8.1 SDK\n* Windows 8.1 x86/x64 Debugging Tools\n\nNote that even if your system has the Windows 10+ x86/x64 Debugging Tools installed, you will still need to install the Windows 8.1 x86/x64 Debugging Tools, as the Windows 10+ version conflicts with the Windows 8.1 SDK headers. The Windows 8.1 x86/x64 Debugging Tools can be installed via the Windows 8.1 SDK installer. If you already have any Debugging Tools installed, the shortcuts in your Start Menu will unfortunately be overwritten.\n\nOnce all prerequisites are installed, simply open up `RebaseExt.sln` in Visual Studio and compile.\n\n## Usage\n\nIn order to use RebaseExt, it must first be loaded into debugger, which can be done via the command\n\n```c++\n.load rebaseext\n```\n\nRebaseExt provides a single command `!re`\n\n```c++\n!re \u003caddress\u003e [\u003cmodule\u003e]\n```\n\nThe `\u003caddress\u003e` parameter allows specifying any kind of expression that the debugger engine can resolve to an address, be it a symbol, a register, or something more complex. If a `\u003cmodule\u003e` is not specified, RebaseExt will assume that `\u003caddress\u003e` refers to a location within the active process, and will scan all loaded modules to find where it may refer to.\n\n```c++\n// Specify a symbol to resolve\n0:000\u003e !re kernel32!CreateFileW+2\n\nRVA: 22ed2\n\nLoaded Address (notepad.exe)\n    Base:    7ff810760000 (KERNEL32)\n    Address: 7ff810782ed2 (KERNEL32!CreateFileW+2)\n\nOriginal Address (KERNEL32.DLL)\n    Base:    180000000 (KERNEL32)\n    Address: 180022ed2 (KERNEL32!CreateFileW+2)\n```\n\nIf the `\u003caddress\u003e` that is specified refers to an RVA or a location in the DLL on disk, the `\u003cmodule\u003e` parameter must be specified so that RebaseExt can figure out what the `\u003caddress\u003e` actually means.\n\n```c++\n// Specify an address to resolve from kernel32\n0:000\u003e !re 180022ed2 kernel32\n\nRVA: 22ed2\n\nLoaded Address (notepad.exe)\n    Base:    7ff810760000 (KERNEL32)\n    Address: 7ff810782ed2 (KERNEL32!CreateFileW+2)\n\nOriginal Address (KERNEL32.DLL)\n    Base:    180000000 (KERNEL32)\n    Address: 180022ed2 (KERNEL32!CreateFileW+2)\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flordmilko%2Frebaseext","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flordmilko%2Frebaseext","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flordmilko%2Frebaseext/lists"}