-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Incorrect kCSNow #2
Comments
Looking at the i386 disassembly, it seems to be pushing 0x0 and 0x80000000 (at offsets 0xC and 0x10):
Hopper pseudocode comparison between i386 vs x86_64:
Perhaps there are two separate arguments? The first one could potentially be a boolean (0x0 or 0x1). For instance, take a look at
There are a couple other references to Another constant could be created for |
See mountainstorm/CoreSymbolication#2 for more information.
It seems kCSNow is
0x8000000000000000llu
instead of0x80000000u
. This makes sense as times are uint64_t.This can be checked by e.g. disassembling the 64-bit part of
/usr/lib/libdtrace.dylib
, functionsymbolOwnerForName
:Source:
Disassembly:
The text was updated successfully, but these errors were encountered: