Repository navigation
ELF: make GetRva return the virtual address relative to the image base - #624
armadavalor wants to merge 1 commit into
Conversation
ElfFile.GetRva subtracted the .text section's vaddr-to-file-offset delta, so it returned a file offset rather than an RVA. On builds where the executable segment is not mapped at its file offset (e.g. 16 KB aligned arm64), the RVA written by the attribute injector was off by that delta. Subtract the lowest PT_LOAD virtual address instead, matching PE.GetRva.
|
Thank you for picking this up so quickly, @armadavalor. I built a18e8ef (this PR) and its base b5ad444 locally (.NET SDK 10.0.100,
The remaining ~0.8% is the same on every format and with or without the change, so I don't think it is related to this PR. The offer from #622 still stands: I can share the binaries privately if that helps. |
ElfFile.GetRvacomputedpointer - (textVaddr - textFileOffset), which is the file offset of the pointer, not an RVA. It only looks right when the executable segment happens to be mapped at its own file offset. On a 16 KB aligned arm64 build the two differ by 0x4000, so theRVAwritten by the attribute injector pointed 0x4000 below the address IDA/Ghidra show (theOffsetfield was already correct).This subtracts the lowest
PT_LOADvirtual address (the image base, 0 for shared objects) instead, which is whatPE.GetRvadoes.MachOFileandNsoFilealready return virtual-address based values._globalOffsetis left alone since the initializer-pointer code still uses it.Added
LibCpp2ILTests/ElfRvaTests.cs, which builds a minimal ELF64 aarch64 image in memory (executable segment 0x4000 above its file offset) and checksGetRvawith image base 0 and non-zero. Both tests fail without the change and pass with it. The existing tests in that project pass as well (7/7); the whole solution builds.I haven't run it against a real 16 KB aligned
libil2cpp.so, only the synthetic image.Closes #622