add ko search readonly

Author: zt20xx

pwnlib/elf/elf.py

@@ -1264,34 +1264,43 @@ def search(self, needle, writable = False, executable = False):
             elif executable:
                 ko_check_segments = [".text"]
             else:
-                # There may be other sections before .rodata, such as .note.gnu.build-id or .note.Linux
-                ko_check_segments = [".text",".data"]
+                ko_check_segments = [".text",".note",".rodata",".data"]
             for section in super().iter_sections():
-                if section.name in ko_check_segments:
-                    filesz = section['sh_size']
-                    offset = section['sh_offset']
-                    data = self.mmap[offset:offset + filesz]
-                    data += b'\x00'
-                    offset = 0
-                    while True:
-                        offset = data.find(needle, offset)
-                        if offset == -1:
-                            break
-                        if section.name == ".data":
-                            text_filesz=0
-                            rodata_filesz=0
-                            for section in super().iter_sections():
-                                if section.name == ".text":
-                                    text_filesz = section['sh_size']
-                                elif len(section.name)>=len(".rodata") and section.name[:len(".rodata")]==".rodata":
-                                    rodata_filesz += section['sh_size']
-                            addr = (text_filesz//PAGESIZE + 1 + rodata_filesz//PAGESIZE + 1)*PAGESIZE
-                        elif section.name == ".text":
-                            addr = 0
-
-                        yield (addr + offset + load_address_fixup)
-                        offset += 1
-
+                if section.name not in ko_check_segments and \
+                       not any(section.name.startswith(ko_check_segment) for ko_check_segment in ko_check_segments):
+                    continue
+                filesz = section['sh_size']
+                offset = section['sh_offset']
+                data = self.mmap[offset:offset + filesz]
+                data += b'\x00'
+                offset = 0
+                while True:
+                    offset = data.find(needle, offset)
+                    if offset == -1:
+                        break
+                    # ko_file: header->.note->.text->.rodata->.data
+                    # after insmod: text page(executable page), note and rodate page(read only page), data page(writable page)
+                    if section.name == ".text":
+                        addr = 0
+                    elif section.name.startswith(".note") :
+                        text_filesz=self.get_section_by_name(".text")['sh_size']
+                        addr = (text_filesz//PAGESIZE + 1)*PAGESIZE + section['sh_offset'] - self.header['e_ehsize']
+                    elif section.name.startswith(".rodata"):
+                        text_filesz=self.get_section_by_name(".text")['sh_size']
+                        text_offset=self.get_section_by_name(".text")['sh_offset']
+                        addr = (text_filesz//PAGESIZE + 1)*PAGESIZE + text_offset - self.header['e_ehsize']
+                    elif section.name == ".data" :
+                        text_filesz=self.get_section_by_name(".text")['sh_size']
+                        rodata_filesz=0
+                        note_filez=0
+                        for section in super().iter_sections():
+                            if section.name.startswith(".rodata"):
+                                rodata_filesz += section['sh_size']
+                            elif section.name.startswith(".node"):
+                                note_filesz += section['sh_size']
+                        addr = (text_filesz//PAGESIZE + 1 + (note_filez+rodata_filesz)//PAGESIZE + 1)*PAGESIZE
+                    yield (addr + offset + load_address_fixup)
+                    offset += 1
     def offset_to_vaddr(self, offset):
         """offset_to_vaddr(offset) -> int