Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
eg: CRYPTSP.CryptDuplicateHash+0C
What does the '0C' mean in this case? Thanks!
-
Do you see this near a line that is exactly 12 source code bytes from the start of the function with that name?– JongwareCommented Jul 11, 2018 at 21:37
Add a comment
|
1 Answer
This indicates the offset within the function.
If you wish to reference an instruction in an executable binary, the most basic and straight-forward method would be using it's full address. However especially with ASLR enabled, different versions, RVA vs file offsets and other nuances it may be more useful to reference an instruction relative to the function start address.
In the case of CRYPTSP.CryptDuplicateHash+0C, we can easily see the address is at offset 0x0C within the CryptDuplicateHash function inside a module called CRYPTSP.