Steven Steven - 10 months ago 53
C Question

macOS - Reading part of other app library code and disassembling it to get offset

My applications read other application memory in order to get pointer. I need firstly to read offset from static library to start working with application itself.

Some function in dylib contains offset to pointer "0x41b1110" - i know that this offset works when used manually, but i need to to read that with my application automatically without checking value manually, if i do simple read from memory from address SomeAddressX as uint64_t it get's ridiculous address which is not equal 0x41b1110. im pretty sure what i got is simply this instruction. Then i have tried read this as byte array, and this byte array was equal to byte array from plain binary at this address. Im wondering how to read simply "0x41b1110" not entire instruction? Do i need to disassembly byte code to x64 instruction and then parse it to get address, or is there smarter way ? Im not much experienced with asm.

SomeAddressX - rax, qword [ds:0x41b1110]

Adding Example byte code and instruction

lea rax, qword [ds:0x1043740]

which gives

48 8D 05 6F D9 99 00

first three
48 8D 05
appears to be
lea rax, qword
but the other part
6F D9 99 00
is not looking like
01 04 37 40 (0x1043740)


Answer Source

It's x64 and enforced PIC (position-independent code) code on OSX (doesn't allow non-PIC executables, as it is using ASLR).

So that disassembly is hiding an important bit of information from you. The true nature of that instruction is revealed here (ba dum ts):

lea    rax,[rip+0x99d96f]

It's using current instruction pointer rip to relatively address it's data.

The 0x1043740 is result of addressOfInstruction + 7 + 0x99d96f.

The 0x99d96f part is clearly visible in the bytecode itself.

The +7 is instruction opcode size. Now I'm not 100% sure it's added too at that stage, so do your own math, as you know "addressOfInstruction".

And check out your debugger options, to see if you can switch between the friendly absolute memory display vs. true rip+offset disassembly.