Why are there absolute jmps in disassembly of position independent code?

Question

I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag.

It's my understanding that as a result, the executable base address will be randomized, and so jumps have to be relative to the current instruction pointer.

However, looking at the output of this PIE binary in Hopper, I see absolute jumps like so:

00000001000021df    mov      rbx, rax
00000001000021e2    test     rbx, rbx
00000001000021e5    je       0x1000021c0

Is Hopper just translating the relative jumps into an absolute jump assuming the text segment is loaded at the standard virtual address of 0x100000000, or am I missing something conceptual with regards to how position independent executables work?

Answer 1

As mentioned in your comment, the corresponding opcode to je 0x1000021c0 is 74 D9. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier for a reverse engineer to understand the flow of the code without having to calculate addresses.

I'll demonstrate what Hopper does with a simple example using radare2 (although you can use your favorite tool to do the same).

First, we'll open radare2 with 10000 empty bytes allocated in rwx permissions so we'll have a "sandbox" to play in:

$ r2 malloc://10000

Since our base address is 0x00000000 we'll seek (go to) to 0x000021e5 so it'll be easier for us to see the relative jump:

[0x00000000]> s 0x21e5
[0x000021e5]>

See how our current address changed to 0x21e5? good !

Now, let's write our hex-bytes (74 d9) in the current address:

[0x000021e5]> wx 74d9

And disassemble one instruction in this address:

[0x000021e5]> pd 1
        ╰─< 0x000021e5      74d9           je 0x21c0

As you can see, radare2, as Hopper does, translated the jump in address0x????21e5 to je 0x????21c0.

Answer 2

well megabeets was faster here is how to check it in windbg

0:000> ? .
Evaluate expression: 1999570342 = 772f05a6
0:000> EB . 74 D9
0:000> U . L1
ntdll!LdrpDoDebuggerBreak+0x2c:
772f05a6 74d9            je      ntdll!LdrpDoDebuggerBreak+0x7 (772f0581)
0:000> ? 772F0581 - .
Evaluate expression: -37 = ffffffdb
0:000> ? 21E5-21C0
Evaluate expression: 37 = 00000025
0:000>