Jump to address

Jumping to a virtual address

Select Tools > Jump to virtual address or press Ctrl+G. Enter the virtual address of the code to inspect. You can also select an address in the listing and invoke Ctrl+G. The decompiler opens the code associated with that address.

A virtual address (VA) identifies a location in the executable image's address space and includes its image base. A file offset identifies a byte position in the file on disk. Do not substitute one for the other: the HEX Editor supports both forms of navigation.

Returning through navigation history

Use the arrow buttons above the tree to move backward and forward through previously viewed procedures. Esc returns to the previous procedure. Mouse Back and Forward buttons also use this history, with the position within the procedure retained.

Sharing a location by its tree path

In Solution explorer, right-click the required object and select Copy the name of section, or press Ctrl+C while the tree has focus. This copies the full path to the selected node.

To revisit that location, select Jump to the section in the tree's context menu, or press G in the tree, and paste the copied path into the dialog. This is useful when handing an investigation to another analyst or returning to a large project. Use the path with the corresponding analyzed file; a path from another build may no longer identify the same code.