I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form:
mov rbp, 7FF633CE2790h jmp rbp
From what I understand, code is meant to be relocatable, so why would a hardcoded address - which appears to be referring to a virtual address not known until runtime - be here?
To deal with these "hardcoded" jump addresses, do I need rebase the PE in IDA to the virtual address it was located at when the program ran? I believe that the dumper I used rebases to 140000000, which of course causes IDA to be unable to analyze the above code.
Edit: here's a concrete example:
game.exe+1B9E0E1E - 45 85 C0 - test r8d,r8d ; ZF = r8d == 0 game.exe+1B9E0E21 - 48 89 6C 24 F8 - mov [rsp-08],rbp ; rsp = &a game.exe+1B9E0E26 - E9 D8897FFF - jmp game.exe+1B1D9803 game.exe+1B1D9803 - 48 8D 64 24 F8 - lea rsp,[rsp-08] ; rsp = &b game.exe+1B1D9808 - 48 BD 7527F508F77F0000 - mov rbp,game.exe+1382775 ; rbp = addr1 game.exe+1B1D9812 - 48 87 2C 24 - xchg [rsp],rbp ; b = addr1, rbp = rbp game.exe+1B1D9816 - E9 E6F33C02 - jmp game.exe+1D5A8C01 game.exe+1D5A8C01 - 48 8D 64 24 F8 - lea rsp,[rsp-08] ; rsp = &c game.exe+1D5A8C06 - 48 89 1C 24 - mov [rsp],rbx ; c = rbx game.exe+1D5A8C0A - 48 89 44 24 F8 - mov [rsp-08],rax ; d = rax game.exe+1D5A8C0F - 48 8D 64 24 F8 - lea rsp,[rsp-08] ; rsp = &d game.exe+1D5A8C14 - E9 D8151C00 - jmp game.exe+1D76A1F1 game.exe+1D76A1F1 - 48 8B 5C 24 10 - mov rbx,[rsp+10] ; rbx = b game.exe+1D76A1F6 - 48 B8 9027F508F77F0000 - mov rax,game.exe+1382790 ; rax = addr2 game.exe+1D76A200 - E9 CA476400 - jmp game.exe+1DDAE9CF game.exe+1DDAE9CF - 48 0F44 D8 - cmove rbx,rax ; rbx = (r8d == 0) ? addr2 : addr1 game.exe+1DDAE9D3 - 48 89 5C 24 10 - mov [rsp+10],rbx ; b = rbx (addr1 or addr2) game.exe+1DDAE9D8 - 48 8B 04 24 - mov rax,[rsp] game.exe+1DDAE9DC - 48 8D 64 24 08 - lea rsp,[rsp+08] ; rsp = &c game.exe+1DDAE9E1 - E9 08F408FD - jmp game.exe+1AE3DDEE game.exe+1AE3DDEE - 48 8B 1C 24 - mov rbx,[rsp] game.exe+1AE3DDF2 - 48 8D 64 24 08 - lea rsp,[rsp+08] ; rsp = &b game.exe+1AE3DDF7 - 48 8D 64 24 08 - lea rsp,[rsp+08] ; rsp = &a game.exe+1AE3DDFC - FF 64 24 F8 - jmp qword ptr [rsp-08] ; r8d == 0: jmp addr2, else jmp addr1 ; addr1 game.exe+1382775 - E9 234F0800 - jmp game.exe+140769D ; addr2 game.exe+1382790 - E9 FDAD991C - jmp game.exe+1DD1D592