Added methods that retrieves the corresponding bytes by specifying a virtual address.

ptrlib/filestruct/elf/elf.py

@@ -258,6 +258,66 @@ def find(self, pattern: Union[str, bytes], writable: Optional[bool]=None, execut
         """
         for result in self.search(pattern, writable, executable):
             yield result
+
+    def addr2offset(self, addr: int) -> Optional[int]:
+        """Returns the offset in the ELF corresponding to a given virtual address.
+
+        Args:
+            addr (int): Virtual address.
+
+        Returns:
+            int | None: Offset. If a non-existent address is specified, None is returned
+        """
+        parser = self._parser
+
+        # serach the segment
+        for segment in parser.segments():
+            if segment["p_type"] == "PT_LOAD":
+                start_vaddr = segment["p_vaddr"]
+                end_vaddr = start_vaddr + segment["p_memsz"]
+
+                if start_vaddr <= addr < end_vaddr:
+                    segment_offset = segment["p_offset"]
+                    offset_from_segment_base = addr - start_vaddr
+                    offset = segment_offset + offset_from_segment_base
+
+                    return offset
+
+        return None
+
+    def read(self, addr: int, size: int) -> Optional[bytes]:
+        """Returns the bytes of a size from a virtual address.
+
+        If a non-existent address is specified, None is returned.
+
+        Unintended behaviour will occur if the segment is crossed.
+
+        Args:
+            addr (int): Start virtual address
+            size (int): Size of bytes
+
+        Returns:
+            bytes | None: Bytes in the file. If a non-existent address is specified, None is returned
+        """
+        parser = self._parser
+
+        offset = self.addr2offset(addr)
+
+        if offset is not None:
+            stream = parser.stream
+            # save position
+            current_offset = stream.tell()
+
+            # get bytes
+            stream.seek(offset)
+            ret = stream.read(size)
+
+            # recover position
+            stream.seek(current_offset)
+
+            return ret
+
+        return None
 
     def plt(self, name: Union[str, bytes]) -> Optional[int]:
         """Get a PLT address

tests/filestruct/elf/test_elf_1.py

@@ -45,6 +45,12 @@ def test_search(self):
         self.assertEqual(next(self.elf.search('A', writable=True)), BASE + 4099264)
         self.assertEqual(next(self.elf.find(b'/bin/sh\0')), BASE + 1785498)
 
+    def test_read(self):
+        # syscall function
+        self.assertEqual(self.elf.read(0x11b820, 0x33), b"H\x89\xf8H\x89\xf7H\x89\xd6H\x89\xcaM\x89\xc2M\x89\xc8L\x8bL$\x08\x0f\x05H=\x01\xf0\xff\xffs\x01\xc3H\x8b\r\x1f\xf6,\x00\xf7\xd8d\x89\x01H\x83\xc8\xff\xc3")
+        # "/bin/sh"
+        self.assertEqual(self.elf.read(1785498, 8), b"/bin/sh\0")
+
     def test_main_arena(self):
         self.elf.base = 0
         self.assertEqual(self.elf.main_arena(), 0x3ebc40)

tests/filestruct/elf/test_elf_10.py

@@ -45,6 +45,16 @@ def test_search(self):
         self.assertEqual(next(self.elf.search('A', writable=True)), BASE + 0x22fb8c)
         self.assertEqual(next(self.elf.find(b'/bin/sh\0')), BASE + 0x1c4de8)
 
+    def test_read(self):
+        # syscall function
+        start = 0x121a50
+        size = 0x37
+        code = b"UWVS\x8bl$,\x8b|$(\x8bt$$\x8bT$ \x8bL$\x1c\x8b\\$\x18\x8bD$\x14e\xff\x15\x10\x00\x00\x00[^_]=\x01\xf0\xff\xff\x0f\x83\xda3\xf0\xff\xc3"
+        self.assertEqual(self.elf.read(start, size), code)
+        # "/bin/sh"
+        start = 0x1c4de8
+        self.assertEqual(self.elf.read(start, 8), b"/bin/sh\0")
+
     def test_main_arena(self):
         self.elf.base = 0
         self.assertEqual(self.elf.main_arena(), 0x231760)

tests/filestruct/elf/test_elf_2.py

@@ -45,6 +45,15 @@ def test_search(self):
         self.assertEqual(next(self.elf.search('A', writable=True)), BASE + 2004929)
         self.assertEqual(next(self.elf.find(b'/bin/sh\0')), BASE + 1787325)
 
+    def test_read(self):
+        # syscall function
+        start = 0x118750
+        size = 0x37
+        code = b"\xf3\x0f\x1e\xfaH\x89\xf8H\x89\xf7H\x89\xd6H\x89\xcaM\x89\xc2M\x89\xc8L\x8bL$\x08\x0f\x05H=\x01\xf0\xff\xffs\x01\xc3H\x8b\r\xf36\r\x00\xf7\xd8d\x89\x01H\x83\xc8\xff\xc3"
+        self.assertEqual(self.elf.read(start, size), code)
+        # "/bin/sh"
+        self.assertEqual(self.elf.read(1787325, 8), b"/bin/sh\0")
+
     def test_main_arena(self):
         self.elf.base = 0
         self.assertEqual(self.elf.main_arena(), 0x1ecb80)

tests/filestruct/elf/test_elf_3.py

@@ -45,6 +45,16 @@ def test_search(self):
         self.assertEqual(next(self.elf.search('A', writable=True)), BASE + 2187072)
         self.assertEqual(next(self.elf.find(b'/bin/sh\0')), BASE + 1948858)
 
+    def test_read(self):
+        # syscall function
+        start = 0x121930
+        size = 0x37
+        code = b"\xf3\x0f\x1e\xfaH\x89\xf8H\x89\xf7H\x89\xd6H\x89\xcaM\x89\xc2M\x89\xc8L\x8bL$\x08\x0f\x05H=\x01\xf0\xff\xffs\x01\xc3H\x8b\r\xb3d\x0f\x00\xf7\xd8d\x89\x01H\x83\xc8\xff\xc3"
+        self.assertEqual(self.elf.read(start, size), code)
+        # "/bin/sh"
+        start = 1948858
+        self.assertEqual(self.elf.read(start, 8), b"/bin/sh\0")
+
     def test_main_arena(self):
         self.elf.base = 0
         self.assertEqual(self.elf.main_arena(), 0x218c60)

tests/filestruct/elf/test_elf_9.py

@@ -45,6 +45,16 @@ def test_search(self):
         self.assertEqual(next(self.elf.search('A', writable=True)), BASE + 0x219529)
         self.assertEqual(next(self.elf.find(b'/bin/sh\0')), BASE + 0x1d8678)
 
+    def test_read(self):
+        # syscall function
+        start = 0x11e870
+        size = 0x37
+        code = b"\xf3\x0f\x1e\xfaH\x89\xf8H\x89\xf7H\x89\xd6H\x89\xcaM\x89\xc2M\x89\xc8L\x8bL$\x08\x0f\x05H=\x01\xf0\xff\xffs\x01\xc3H\x8b\rs\xb5\x0f\x00\xf7\xd8d\x89\x01H\x83\xc8\xff\xc3"
+        self.assertEqual(self.elf.read(start, size), code)
+        # "/bin/sh"
+        start = 0x1d8678
+        self.assertEqual(self.elf.read(start, 8), b"/bin/sh\0")
+
     def test_main_arena(self):
         self.elf.base = 0
         self.assertEqual(self.elf.main_arena(), 0x21ac80)