Skip to content

How to disassemble rip relative addresses #283

Answered by wtfsck
Kixiron asked this question in Q&A
Discussion options

You must be logged in to vote

The address argument should be 0x268F9AC0048 since that's the address used by the operand (rip relative), so your code above should work assuming the address comparisons are correct above.

If your hard coded addresses, eg. ffi::io_error_encountered, are all relative to the beginning of the image, then you need to subtract the image base address from address before the comparison.

Replies: 1 comment

Comment options

You must be logged in to vote
0 replies
Answer selected by wtfsck
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
2 participants