title: Get the real import symbol address on Visual Studio 2017
body: <p>Can someone explain why I cannot get the corresponding address with <code>req-&gt;request_body-&gt;post_handler</code> from <code>ngx_http_upstream_init</code> and how to get it correctly?</p>
  <p>Code Snippet:</p>
  <pre class="lang-cpp prettyprint-override"><code>// Note: for debug test only
  // https://reverseengineering.stackexchange.com/questions/14422/how-do-i-know-the-bytes-corresponding-to-an-instruction-in-hex-view-in-ida
  logdf(&quot;%p, %p&quot;, ngx_http_upstream_init, req-&gt;request_body-&gt;post_handler);
  ngx_http_upstream_init(req);
  req-&gt;request_body-&gt;post_handler(req);
  assert(ngx_http_upstream_init == req-&gt;request_body-&gt;post_handler);
  // Skip post_handler because we don't want to create the upstream to the proxied server right now.
  return NGX_HTTP_EM_HAS_SUBREQUEST(req) &amp;&amp; 0 == req-&gt;request_body-&gt;rest ? NGX_AGAIN : NGX_OK;
  </code></pre>
  <p>The log:</p>
  <pre><code>ngx_http_request_body_filter_by_em|2681|00007FFACC961617, 00007FF727A8BA37
  </code></pre>
  <p>And, in the Disassembly window,</p>
  <pre><code>                ;ngx_http_upstream_init(req);
  00007FFACC9E66D1 48 8B 8D C0 01 00 00 mov         rcx,qword ptr [req]  
  00007FFACC9E66D8 E8 3A AF F7 FF       call        ngx_http_upstream_init (07FFACC961617h)  
                  ;req-&gt;request_body-&gt;post_handler(req);
  00007FFACC9E66DD 48 8B 85 C0 01 00 00 mov         rax,qword ptr [req]  
  00007FFACC9E66E4 48 8B 80 90 03 00 00 mov         rax,qword ptr [rax+390h]  
  00007FFACC9E66EB 48 8B 8D C0 01 00 00 mov         rcx,qword ptr [req]  
  00007FFACC9E66F2 FF 50 40             call        qword ptr [rax+40h]
  </code></pre>
  <p>Howerver, in the Immediate Window (corresponding to tooltip mouse when hovering my mouse cursor over them in VS2017):</p>
  <pre><code>ngx_http_upstream_init
  0x00007ffacc9f6041 {ngx_http_em_module.dll!ngx_http_upstream_init}
  req-&gt;request_body-&gt;post_handler
  0x00007ff727a8ba37 {NGINX.exe!ngx_http_upstream_init}
  </code></pre>
  <p>I found its output is different from the previous two cases.</p>
  <p>Some pictures,</p>
  <p><a href="https://i.stack.imgur.com/J5uSU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/J5uSU.png" alt="Disassembly of c++ code" /></a></p>
  <p><a href="https://i.stack.imgur.com/f9oKJ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/f9oKJ.png" alt="Disassembly from module.dll!ngx_http_upstream_init to NGINX.exe!ngx_http_upstream_init" /></a></p>
  <p><a href="https://i.stack.imgur.com/EE2eH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EE2eH.png" alt="Disassembly from req-&gt;request_body-&gt;post_handler" /></a></p>
  <p><a href="https://i.stack.imgur.com/v1Nzv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/v1Nzv.png" alt="IDA View" /></a></p>