Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve Use-Case for Patching Relocations with MemoryMap #5916

Open
bpotchik opened this issue Sep 10, 2024 · 0 comments
Open

Improve Use-Case for Patching Relocations with MemoryMap #5916

bpotchik opened this issue Sep 10, 2024 · 0 comments
Assignees
Labels
Component: Relocations Effort: Medium Issue should take < 1 month Impact: Medium Issue is impactful with a bad, or no, workaround Type: Enhancement Issue is a small enhancement to existing functionality

Comments

@bpotchik
Copy link
Member

bpotchik commented Sep 10, 2024

Additional work required from original issue: #4950 While we have the ability to patch bytes in regions with relocations using the new MemoryMap, the current implementation is somewhat raw and can be improved for better usability and control. Here’s an example demonstrating the existing behavior:

>>> relo = bv.relocation_ranges[0]
>>> relo_size = relo[1] - relo[0]
>>> relo_size
4
>>> bv.read(relo[0], relo_size)
b'H\x10\x01\x00'
>>> bv.write(relo[0], b'\xff' * 4)
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/Applications/Binary Ninja.app/Contents/MacOS/plugins/../../Resources/python/binaryninja/binaryview.py", line 4232, in write
    raise RelocationWriteException("Attempting to write to a location which has a relocation")
binaryninja.exceptions.RelocationWriteException: Attempting to write to a location which has a relocation

# Note we do not define any permissions, the region will inherit the permissions from the existing shadowed region.
>>> bv.memory_map.add_memory_region("my_writable_relo", relo[0], b'\xff' * 4)
True
>>> bv.read(relo[0], relo_size)
b'\xff\xff\xff\xff'
>>> bv.write(relo[0], b'\xda' * 4)
4
>>> bv.read(relo[0], relo_size)
b'\xda\xda\xda\xda'

While this works, currently adding a memory region ends up modifying the segment map:

r-x  0x00008000-0x00008528 
rw-  0x00010f0c-0x0001100c 
rw-  0x0001100c-0x00011010  <<<< 4 byte segment for the relocation

Need to investigate the following:

  • Implement a method to prevent segment bloat when patching relocations. Perhaps adding a hidden MemoryMap layer that handles patches and relocations separately from the main memory regions.
  • Explore ways to automate the relocation patching process in the UI
@bpotchik bpotchik self-assigned this Sep 10, 2024
@xusheng6 xusheng6 added Type: Enhancement Issue is a small enhancement to existing functionality Effort: Medium Issue should take < 1 month Impact: Medium Issue is impactful with a bad, or no, workaround Component: Relocations labels Sep 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Component: Relocations Effort: Medium Issue should take < 1 month Impact: Medium Issue is impactful with a bad, or no, workaround Type: Enhancement Issue is a small enhancement to existing functionality
Projects
None yet
Development

No branches or pull requests

2 participants