From 9bfd895fc41f23cf85dc068e2c39910ca423ddf0 Mon Sep 17 00:00:00 2001 From: J Reece Wilson Date: Fri, 15 Sep 2023 23:50:00 +0100 Subject: [PATCH] [*] Linux: replace the initial map scanners aggressive filtering to not dismiss potential hits. Also parses file offsets for these section maps. --- Source/Process/AuProcessMap.Linux.cpp | 76 ++++++++++++++++++++++++--- 1 file changed, 68 insertions(+), 8 deletions(-) diff --git a/Source/Process/AuProcessMap.Linux.cpp b/Source/Process/AuProcessMap.Linux.cpp index 50e87238..540728e5 100644 --- a/Source/Process/AuProcessMap.Linux.cpp +++ b/Source/Process/AuProcessMap.Linux.cpp @@ -22,12 +22,12 @@ namespace Aurora::Process { void InitProcessMapLinux() { - //puts("InitProcessMapLinux"); + } void DeinitProcessMapLinux() { - //puts("DeinitProcessMapLinux"); + } static AuHashMap>>> gModuleMap; @@ -44,7 +44,6 @@ namespace Aurora::Process if (!AuIOFS::FileExists(fileName)) { - //printf("drop: %s\n", fileName.c_str()); return 0; } @@ -76,6 +75,7 @@ namespace Aurora::Process Sections sections; AuParse::SplitNewlines(map, [&](const AuString &line) { + bool bIsSpecialFile {}; char *endPtr; auto base = strtoll(line.c_str(), &endPtr, 16); if (errno == ERANGE) return; @@ -90,6 +90,10 @@ namespace Aurora::Process auto A = line.find_first_of(':'); if (A == AuString::npos) return; + auto offsetStart = perms + 5; + auto uFileOffset = strtoll(offsetStart, &endPtr, 16); + if (errno == ERANGE) uFileOffset = 0; + A += 4; auto gross = line.substr(A); @@ -119,10 +123,26 @@ namespace Aurora::Process if (name.size()) { - bool bIsFile = AuIOFS::FileExists(name); - if (bIsFile) + bIsSpecialFile = AuIOFS::FileExists(name); + + if (bIsSpecialFile) { - return; + for (const auto &[uBaseAddress, pathSectionPair] : gModuleMap) + { + if (uBaseAddress == base) + { + return; + } + + for (auto &[a, b, c, d] : AuGet<1>(pathSectionPair)) + { + if ((uBaseAddress + a) <= base && + (uBaseAddress + a + c) > base) + { + return; + } + } + } } } @@ -131,13 +151,53 @@ namespace Aurora::Process sect.origVa = 0; sect.baseVa = base; sect.size = end - base; - sect.fsOff = 0; + sect.fsOff = uFileOffset; sect.pt.readable = perms[0] == 'r'; sect.pt.writable = perms[1] == 'w'; sect.pt.NX = perms[2] != 'x'; - sect.name = AuMove(name); + if (bIsSpecialFile) + { + // edge case: these are like windows nt section views + // insert these as their own modules + // (we cant present Sections of weakly owned files ) + static AuMutex gLock; + static AuHashMap> gMap; + + sect.name = kSectionNameFile; + + AU_LOCK_GUARD(gLock); + + auto &refMod = gMap[name]; + if (refMod) + { + // already cached + } + else + { + refMod = AuMakeShared(); + if (!refMod) return; + + refMod->moduleMeta = AuMakeShared(); + if (!refMod->moduleMeta) return; + + AuString fileName; + AuIOFS::GetFileFromPath(fileName, name); + refMod->moduleMeta->moduleBase = base; + refMod->moduleMeta->moduleName = fileName; + refMod->moduleMeta->modulePath = name; + refMod->moduleMeta->origVa = 0; + } + + sect.moduleMeta = refMod; + } + else + { + // most likely + sect.name = AuMove(name); + } + AuTryInsert(sections, sect); }, false);