Skip to content

Handle virtual address to file offset mapping in a standard way #51

@mjhouse

Description

@mjhouse

Is your feature request related to a problem? Please describe.
There are intricacies to the symbol values when they refer to data in a section, and currently deaf ignores them. Much of the specifics of the memory layout don't apply to deaf because we analyzing the files on disk, rather than after they have been loaded into memory. There may still be some gotchas though.

Describe the solution you'd like
Investigate address/offset resolution and figure out if we need to do anything special. May end up adding an offset or address getters on the symbol struct that calculate those values from the st_value field for the caller.

Describe alternatives you've considered
N/A

Additional context
Refer to the following pages to for explanations of the problem(s):

  1. https://jvns.ca/blog/2018/01/09/resolving-symbol-addresses/
  2. https://reverseengineering.stackexchange.com/a/16842
  3. https://stackoverflow.com/a/73176119

Screenshot using readelf and dd to extract the value of a data symbol:
image

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions