As ImageBase will not always be the same, will need to configure IDA so that the base address used is the base address used in runtime.

  1. Attach the process to WinDBG first. Then execute lm m notepad (example for notepad) to get the start address for the module.
  2. Go to IDA then load the file (for 32 bit usually is Portable executable for 80386).
  3. In IDA, Edit->Segments->Rebase program and enter the start address from WinDBG with a 0x prefix. (for example 1200 become 0x1200)
  4. In IDA, go to Options->General->Line prefixes (graph). Enable this.
  5. Now if you see interesting address in WinDBG, can just press G in IDA, enter the address and will reach the same address.