Open nedwill opened 9 years ago
Hmm, so I did that because of page mappings, but feel free to make it more granular(add sections). I agree it'll improve the haddrline, and you can use static to track sections.
Now that we know shellcode works(it reconstructs the Instruction from the dynamic memory store on view, not the worst solution), this actually looks more like a bug than dynamic static.
I'm beginning work on the IDA plugin, and I noticed that sometimes selecting data in IDA does not select the data back in QIRA. This is because QIRA filters any
setdaddr
for an address it believes is an instruction.In ida.js:
But
get_data_type
looks this up in the pmap that ultimately comes from the qiradb. The pmaps are stored by page, masked off withPAGE_MASK
. If any instructions from that page are executed, the entire page is marked withPAGE_INSTRUCTION
.Trace.cpp:
But sometimes code and data are in the same page. See
double_link
:According the pmap, only
.init_array
and.fini_array
are data, even though.rodata
andeh_frame*
are data too. Either I'm misunderstanding something here or we can do better by having static be responsible for informing the UI about the sections. This could lead to a more accurate haddrline as well.