2

Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.

eg: CRYPTSP.CryptDuplicateHash+0C

What does the '0C' mean in this case? Thanks!

1
  • Do you see this near a line that is exactly 12 source code bytes from the start of the function with that name?
    – Jongware
    Jul 11 '18 at 21:37
3

This indicates the offset within the function.

If you wish to reference an instruction in an executable binary, the most basic and straight-forward method would be using it's full address. However especially with ASLR enabled, different versions, RVA vs file offsets and other nuances it may be more useful to reference an instruction relative to the function start address.

In the case of CRYPTSP.CryptDuplicateHash+0C, we can easily see the address is at offset 0x0C within the CryptDuplicateHash function inside a module called CRYPTSP.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.