If you're ever wondering what the load address of a piece of code is, my favourite trick is to:
1) identify relative addresses of all C-style strings from the start of the binary
2) identify all absolute read addresses
3) find the load address where the most read addresses correspond to the most strings
This solves the problem for me in the vast majority of cases. If you don't have strings, function prologues work as well.
I don't think there's any tooling for this yet. I've had to write the same algorithm over and over. It works regardless of any header information at the start of the binary, though it will fail if there is data between chunks (but you may see multiple valid alignments that can hint to something like this happening)
1) identify relative addresses of all C-style strings from the start of the binary
2) identify all absolute read addresses
3) find the load address where the most read addresses correspond to the most strings
This solves the problem for me in the vast majority of cases. If you don't have strings, function prologues work as well.
I don't think there's any tooling for this yet. I've had to write the same algorithm over and over. It works regardless of any header information at the start of the binary, though it will fail if there is data between chunks (but you may see multiple valid alignments that can hint to something like this happening)