Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
What does the '0C' mean in this case? Thanks!
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
This indicates the offset within the function.
If you wish to reference an instruction in an executable binary, the most basic and straight-forward method would be using it's full address. However especially with ASLR enabled, different versions, RVA vs file offsets and other nuances it may be more useful to reference an instruction relative to the function start address.
In the case of
CRYPTSP.CryptDuplicateHash+0C, we can easily see the address is at offset
0x0C within the
CryptDuplicateHash function inside a module called