Question

#include <stdint.h>
uint64_t rip;
int main()
{
    asm(
        "movq %%rip, %0\n" : "=m" (rip)
        );

    sleep(10);
}

When I compile I get

cc -m64    rip.c   -o rip
/tmp/ccwNbZi1.s: Assembler messages:
/tmp/ccwNbZi1.s:12: Error: suffix or operands invalid for `movq'
make: *** [rip] Error 1

Answer 1

You can’t read (E|R)IP because there’s no x86(/64) instruction to read it directly.

The only way to "read" it is to make a call with the CALL instruction. It will save the return address on the stack and that one you can read.

UPDATE: In 64-bit mode you can exploit the RIP-relative addressing, so LEA RAX, [RIP] will give you the address of itself in RAX. Yet another workaround is MOV RAX, $ in assembly.