title: Find address in x64 executable from memory address
body: <p>This post (<a href="https://stackoverflow.com/questions/34094781/find-an-instruction-in-an-executable-file-given-its-address-in-a-running-proces">Find an instruction in an executable file, given its address in a running process?</a>)
  contains detailed instructions how to calculate an address within an executable file from a memory address of a running process. </p>
  
  <p>How do I determine the base address to use if I want to apply the formula to an x64 executable?</p>
  
  <p>For x86 it is 0x400000. My assumption was that this comes from the IMAGE_BASE field of the optional PE header. However, this field contains the value 0x140000000 for x64. The used addresses in the x64 binary are actually much smaller than the ones in the x86 binary.</p>