Resolve rip-relative addresses from otool

from blog The Desolation of Blog, | ↗ original
You can use /usr/bin/otool -tV from the command-line to disassemble Mach-O files. If you don't know what Mach-O's are, they're like Krusty-O's only tastier and healthier. One problem with otool, however, is that it doesn't resolve rip-relative addresses. In the x86_64 (64-bit Intel) architecture, rip is the register that contains the instruction pointer. A rip-relative address is an address specified by an offset, either positive or negative, from the instruction pointer. For example, 0x99eac(%rip) is an rip-relative address in this disassembly:
This is a short summary. ↗ Open original to view full content

Related

Playing with Mach-O binaries and dyld
LSE Blog | original ↗
Running Assembly on OS X
Lord.io | original ↗
From 0 to 1 MB in DOS
Julio Merino (jmmv.dev) | original ↗
GNU Assembler RISC-V Directives
Daniel Mangum | original ↗
gdb on OS X
Lord.io | original ↗
Recovering deleted files using only grep
Alex Clemmer | original ↗
Reverse Engineering x86 assembly
the website of jyn | original ↗
OpenTitan Assembly Style Guide
Daniel Mangum | original ↗
A Minimal Rust Kernel
Writing an OS in Rust | original ↗
Kernel from Scratch
Technical Journal | original ↗

More from The Desolation of Blog

Technology is never a substitute for consent
4 Jan 2025 | original ↗

This is a follow-up to my recent blog posts Apple Photos phones home on iOS 18 and macOS 15 and The internet is full of experts. I've read a lot of the discussion about and responses to my blog posts, which has forced me to hone my own thinking and arguments on the subject. I characterized Apple's new Enhanced Visual Search feature as a privacy...

The internet is full of experts
31 Dec 2024 | original ↗

My recent blog post Apple Photos phones home on iOS 18 and macOS 15 has received widespread attention, and perhaps inevitably, it has also received widespread criticism by random internet commenters. A common criticism is that I somehow discredited myself by stating, honestly, "I don't understand most of the technical details of Apple's blog...

Apple Photos phones home on iOS 18 and macOS 15
28 Dec 2024 | original ↗

This morning while perusing the settings of a bunch of apps on my iPhone, I discovered a new setting for Photos that was enabled by default: Enhanced Visual Search. (I manually disabled it before taking the screenshot below.) Apps > Photos"> This setting is also new to Photos on macOS Sequoia, and enabled by default. Oddly, this new feature has...

Deep dive into a macOS default web browser bug
20 Dec 2024 | original ↗

This blog post has undergone some revision and correction since first published. It turns out, contrary to my initial assumption, that the code signatures of the apps is largely irrelevant. Thanks to Avi Drissman of the Google Chrome team for assistance! According to the Apple Developer Documentation, "macOS Launch Services is an API that enables...

How Safari 18.2 https upgrade works
12 Dec 2024 | original ↗

Yesterday, Apple released Safari version 18.2, included with iOS 18.2 and macOS 15.2, as a separate update for macOS 14 and 13. I've already discussed one new feature of Safari 18.2, Copy Link with Highlight, in another blog post. Now I'd like to discuss another new feature, automatic https upgrade. From Apple's announcement: Safari 18.2 on iOS,...