Why can't I save the value of rip? [duplicate]

Answer 1

The only way I can think of to get/set %rip under x86_64 is to use ptrace(). Below is copied from source of ltrace.

void* addr = ptrace(PTRACE_PEEKUSER, pid, (8 * RIP), 0);
ptrace(PTRACE_POKEUSER, pid, (8 * RIP), addr);

where RIP is a macro defined in /usr/include/sys/reg.h

Answer 2

You can't read (E|R)IP because there's no x86(/64) instruction to read it directly.

The only way to "read" it is to make a call with the CALL instruction. It will save the return address on the stack and that one you can read.

UPDATE: In 64-bit mode you can exploit the RIP-relative addressing, so LEA RAX, [RIP] will give you the address of itself in EAX. Yet another workaround is MOV RAX, $ in assembly.