I have those opcodes on 64 bits:
48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb].
How can I get the 0x31bb value from those opcodes and how can I know if I have a
+ sign or a
- sign beetween operands (
rip - 0x31bb or
rip + 0x31bb ) ?
You can get that value from the last 4 bytes of the opcode.
45 CE FF FF
You need to reverse the order of bytes and the the value is written as 2's complement. Since the highest bit is 1 it will be negative.
(0xFFFFCE45) in 2's = -0x31BB