Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support reading PE data directly from memory (sections are page aligned) #548

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

valaphee
Copy link

At the moment its not possible to load PE data from memory, because sections are located at the virtual_address, not pointer_to_raw_data because of page alignment.

This pr unifies file "address space" and virtual address space, by adding a bool to SectionTable which specifies the location to use.

@philipc
Copy link
Contributor

philipc commented May 19, 2023

Do you need this functionality in PeFile, or would it suffice to add something similar such as PeMemory?

Can you add a test for this? It's okay if the test only runs on Windows. This will also give me a better understanding of how you plan to use this.

@valaphee
Copy link
Author

Could also be a different struct, but would be nearly identical to PeFile,

Sure, the reason why I added this was to use it with my debugger written in Rust, where I wanted to directly read the executable from memory.

Ideally I would also check how other formats work/how they get loaded into memory.

@philipc
Copy link
Contributor

philipc commented May 23, 2023

I had a look at how you are using this in your code, and based on that I agree that it makes sense for this to be an option to PeFile. However, I'm still a bit uncertain as to whether the entire PeFile API will work for this. As such, I want to spend some time looking into this further to satisfy myself. I may not have time to do that for a while though, so apologies in advance for any delay.

For ELF, I think only the PT_LOAD segments specified by the program headers are loaded. You can get a list of the program headers from dl_iterate_phdr, but the rest of the ELF file isn't accessible, so a similar approach can't be used for ElfFile.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants