-
|
First off I want to say that I love the library, it's amazingly comprehensive which is a godsend for this kind of thing. sub rsp, 0x20
mov rcx, rsi
mov edx, 0x65
mov rdi, [0x268F9AC0048]
; Or, when displaying rip relative addresses is enabled:
; mov rdi, [rip - 0x100C1]
call rdi
add rsp, 0x20
test al, 1
jne .LBL_0The function being called has an address of impl SymbolResolver for Resolver {
fn symbol(
&mut self,
_instruction: &Instruction,
_operand: u32,
_instruction_operand: Option<u32>,
address: u64,
_address_size: u32,
) -> Option<SymbolResult<'_>> {
let function = if address == ffi::io_error_encountered as u64 {
"io_error_encountered"
} else if address == ffi::input as u64 {
"input"
} else if address == ffi::output as u64 {
"output"
} else {
return None;
};
Some(SymbolResult::with_str_kind(
address,
function,
FormatterTextKind::FunctionAddress,
))
}
}I'm thinking that this could be because the code being disassembled is position independent a la |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment
-
|
The If your hard coded addresses, eg. |
Beta Was this translation helpful? Give feedback.
The
addressargument should be0x268F9AC0048since that's the address used by the operand (rip relative), so your code above should work assuming the address comparisons are correct above.If your hard coded addresses, eg.
ffi::io_error_encountered, are all relative to the beginning of the image, then you need to subtract the image base address fromaddressbefore the comparison.