2

A jump table I am reversing uses relative offsets to both data and functions. These relative offsets are 32-bit integers added to the address that the value is stored at. Does Ghidra support typing these as relative addresses for generating references (like how you can type a value as an absolute address by pressing P)?

For example:

                                 INT_00010f00                                            
           00010f00 49 ff ff ff       int          FFFFFF49h

Is actually a reference to 0x00010f00 + 0xffffff49 = 0x00010e49

1 Answer 1

1

You can always set it manually to the specific address from the reference dialog (available under R). There you can providing the correct address calculated by adding base address and an offset. If you have more than one, you can automate it via python script.

I've recorded a video detailing such situation in action https://www.youtube.com/watch?v=FvH7b_qLmbU

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.