bloomberg / pystack

🔍 🐍 Like pstack but for Python!
https://bloomberg.github.io/pystack
Apache License 2.0
1.01k stars 45 forks source link

Take into account the load point when copying memory from ELF files #183

Closed pablogsal closed 1 month ago

pablogsal commented 4 months ago

When we need to copy memory from ELF files (normally from the static data section) we need to take into account the load point of the first PT_LOAD segment to properly map an address to an offset in the file. Our procedure to do this transformation is to find the first loaded map in /proc/PID/maps and then calculate the offset of the target address from the start of this map. This offset only will be the same as the offset from the start of the ELF file if the load point of the corresponding PT_LOAD segment is 0, otherwise we need to calculate it to ensure we are mapping it correctly.

Closes: #174