Example #1
0
        /// <summary>
        /// Gets the module load offset.
        /// </summary>
        /// <param name="baseAddress">The module base address.</param>
        public ulong GetModuleLoadOffset(ulong baseAddress)
        {
            // Check if we are looking for load offset of main module
            if (baseAddress == files[0].start)
            {
                // Find file with symbols for main module
                string mainModulePath = files[0].name;

                if (!string.IsNullOrEmpty(mainModulePath))
                {
                    mainModulePath = ElfCoreDumpDebuggingEngine.GetModuleMappedImage(this, mainModulePath);
                }

                // Find offset for main module
                ulong offset = 0;

                if (!string.IsNullOrEmpty(mainModulePath))
                {
                    var elf = ELFReader.Load <ulong>(mainModulePath);
                    foreach (AuxvEntry entry in auxVector)
                    {
                        if (entry.Type == AuxvEntryType.Entry)
                        {
                            offset = entry.Value - elf.EntryPoint;
                            break;
                        }
                    }
                }

                return(offset);
            }

            return(0);
        }
Example #2
0
        /// <summary>
        /// Gets the size of the module.
        /// </summary>
        /// <param name="baseAddress">The module base address.</param>
        public ulong GetModuleSize(ulong baseAddress)
        {
            string name      = files.First(f => f.start == baseAddress).name;
            string imagePath = ElfCoreDumpDebuggingEngine.GetModuleMappedImage(this, name);

            if (!string.IsNullOrEmpty(imagePath))
            {
                // Return file size
                return((ulong)(new FileInfo(imagePath).Length));
            }

            ulong endAddress = 0;

            foreach (elf_note_file file in files)
            {
                if (file.name == name)
                {
                    endAddress = Math.Max(endAddress, file.end);
                }
            }

            return(endAddress - baseAddress);
        }