Codatify doesnt work if .text / .data sections are missing.

[fuzzywalls]

ARM binaries seem to not create them. Find a different way to discover code vs data.

[astrelsky]

There are methods to check if a memory block is executable and if a block is read/write/volatile if this helps at all.

[fuzzywalls]

That might be necessary, I'm not sure yet. Currently I'm experimenting with getFirstData, getLastData, getFirstFunction, and getLastFunction to find the necessary blocks and creating address ranges around those. Worked well for fixing up the code, but fixing up the data requires a little more processing.

[fuzzywalls]

@astrelsky The getFirstX route was a dead end because there is no guarantee the functions will be in one contiguous block. I experimented with the permission methods you mentioned in an ARM binary. Single memory blocks contained code and data which means it was marked with execute and read permissions, so not a lot to go on with that. I was able to do something similar by using a memory manager function, getExecuteSet, it returned a range of what it considered code. This still contained some data, which introduces some false positives, but it is at least working. Going to try and lower the false positive rates a little now.

[astrelsky]

@astrelsky The getFirstX route was a dead end because there is no guarantee the functions will be in one contiguous block. I experimented with the permission methods you mentioned in an ARM binary. Single memory blocks contained code and data which means it was marked with execute and read permissions, so not a lot to go on with that. I was able to do something similar by using a memory manager function, getExecuteSet, it returned a range of what it considered code. This still contained some data, which introduces some false positives, but it is at least working. Going to try and lower the false positive rates a little now.

You could probably filter them further by checking if at least one disassembled instruction already exists in the memory block. If the block isn't writeable then it is more likely to only contain instructions. It can still potentially have data though.