Hardcoded addresses in dumped PEs

Question

I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form:

mov rbp, 7FF633CE2790h
jmp rbp

From what I understand, code is meant to be relocatable, so why would a hardcoded address - which appears to be referring to a virtual address not known until runtime - be here?

To deal with these "hardcoded" jump addresses, do I need rebase the PE in IDA to the virtual address it was located at when the program ran? I believe that the dumper I used rebases to 140000000, which of course causes IDA to be unable to analyze the above code.

Edit: here's a concrete example:

 game.exe+1B9E0E1E - 45 85 C0              - test r8d,r8d              ; ZF = r8d == 0
 game.exe+1B9E0E21 - 48 89 6C 24 F8        - mov [rsp-08],rbp          ; rsp = &a
 game.exe+1B9E0E26 - E9 D8897FFF           - jmp game.exe+1B1D9803

 game.exe+1B1D9803 - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &b
 game.exe+1B1D9808 - 48 BD 7527F508F77F0000 - mov rbp,game.exe+1382775 ; rbp = addr1
 game.exe+1B1D9812 - 48 87 2C 24           - xchg [rsp],rbp            ; b = addr1, rbp = rbp
 game.exe+1B1D9816 - E9 E6F33C02           - jmp game.exe+1D5A8C01

 game.exe+1D5A8C01 - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &c
 game.exe+1D5A8C06 - 48 89 1C 24           - mov [rsp],rbx             ; c = rbx
 game.exe+1D5A8C0A - 48 89 44 24 F8        - mov [rsp-08],rax          ; d = rax
 game.exe+1D5A8C0F - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &d
 game.exe+1D5A8C14 - E9 D8151C00           - jmp game.exe+1D76A1F1

 game.exe+1D76A1F1 - 48 8B 5C 24 10        - mov rbx,[rsp+10]          ; rbx = b
 game.exe+1D76A1F6 - 48 B8 9027F508F77F0000 - mov rax,game.exe+1382790 ; rax = addr2
 game.exe+1D76A200 - E9 CA476400           - jmp game.exe+1DDAE9CF

 game.exe+1DDAE9CF - 48 0F44 D8            - cmove rbx,rax             ; rbx = (r8d == 0) ? addr2 : addr1
 game.exe+1DDAE9D3 - 48 89 5C 24 10        - mov [rsp+10],rbx          ; b = rbx (addr1 or addr2)
 game.exe+1DDAE9D8 - 48 8B 04 24           - mov rax,[rsp]                      
 game.exe+1DDAE9DC - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &c
 game.exe+1DDAE9E1 - E9 08F408FD           - jmp game.exe+1AE3DDEE              

 game.exe+1AE3DDEE - 48 8B 1C 24           - mov rbx,[rsp]
 game.exe+1AE3DDF2 - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &b
 game.exe+1AE3DDF7 - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &a
 game.exe+1AE3DDFC - FF 64 24 F8           - jmp qword ptr [rsp-08]    ; r8d == 0: jmp addr2, else jmp addr1

 ; addr1
 game.exe+1382775 - E9 234F0800           - jmp game.exe+140769D

 ; addr2
 game.exe+1382790 - E9 FDAD991C           - jmp game.exe+1DD1D592

Answer 1

From reading up about the obfuscation tool in use here, this is a technique it uses to make the analysis a little harder.

Now the question is how to work around this:
I'm thinking I could use a script to find these absolute addresses in the dumped PE, and convert them to ones that IDA can find.

Any other ideas?

Edit:

After loading the dumped executable into IDA with a couple of different base addresses, I've found that the address constant changed. I've also found an entry in the executable's relocation directory for game.exe+1B1D980A (which is where the address constant in the code example is located).

If I could disable the relocation that IDA is performing on these addresses, the analysis would work properly. I will submit a new question on that.

Answer 2

One possible explanation could be dealing with a game which incorporates Absolute code.

Usually most of the games you run on a regular daily machine are fully relocatable for ensuring maximum stability across different machines. However especially in the case of ROMs such as games for consoles and such there are some predefined memory locations which the manufacturer / OS could provide / specify for say making it easier and faster to run console-specific functions.

Basically, a code like that usually relies on a known memory location which the linker / programmer trusts and is certain that it contains the appropriate code, locations like that could e explicitly specified in the machine documentation / developer guide.

As this is a PE which is on Windows it looks a little weird, especially since the address is I the range of the per process VA space, probably this address indeed points to some special function or that the process itself requested this location to be allocated and loaded with code for usage as a part of the obfuscation which might pose a justification to such call and to trusting this address.