BinaryView.add_user_segment by a memory region, not by a file offset

[Ouroboros]

Hi, I want to call BinaryView.add_user_segment(self, start, length, data_offset, data_length, flags) by using a memory address and length for data_offset and data_length, instead of a valid file offset & length. Is it possible?

[psifertex]

Sorry for the delay. It depends a bit on what you are trying to do. There are a few ways you can achieve what we think your goal is:

• if you're creating a binary view and want to alias memory, you can just back to the same native location
• if you want to map some other region of memory to apply types, you can specify a length of 0 and then still apply types even though there's no bytes there
• one clarification that data_offset and data_length aren't necessarily for the raw file, they're for the parent binaryview. Most of the time that will be a file, in which case you can just append bytes to the end and specify them, or you can even create a binaryview to the file and then a second binaryview as a child process. Hop on the slack for a longer explanation of this process
• finally, (and I don't think this is what you're asking from your phrasing but it's related and we hear it often) if you want to provide a specific sequence of bytes you

Does that help?

[Ouroboros]

Hi, Thanks for your reply!

Seems that your last goal is the same as my problem, except that I will provide those bytes afterwards. Let me clarify my problem.
I want to do the following steps:

1. Allocate some memory b;
2. Call add_user_segment with b;
3. Fill b with my own ASM.

The above steps require a writable b. Now the problem is that, if I call add_user_segment without a file offset, I will get read-only memory address and therefore I can't do Step 3.

Can you give me some advice about creating a segment with a memory address and size, while the new segment is writable?

[psifertex]

What is the main binaryview in this case? If you're working on one of our existing formats like mach-o, pe, or elf it would require appending some empty bytes. If it's your own custom binaryview or you're loading a flat binary file, you can do it with a subview. @rssor can chime in with more details on the subview method.

[Ouroboros]

If you're working on one of our existing formats like mach-o, pe, or elf it would require appending some empty bytes.

Yes, I am working with mach-o format. I have tried appended some empty bytes to the file itself, but it doesn't work since the size of the code segment is still the same

For example , given this mach-o:

I want to have a new segment other than 0x100000000-0x107E6A7E0 that is Allow write and Allow execute.

like this:

from idc import *
base = 0x108000000
seg_size = 0x6D4000
add_segm_ex(base, base + seg_size, 0X1, 2, 1, 2, ADDSEG_NOSREG)
set_segm_name(base, "patch")
set_segm_class(base, "CODE")
set_segm_type(base, 2)

patch_byte(0x103b96fd0, 0xc)
patch_byte(0x103b96fd1, 0xa4)
patch_byte(0x103b96fd2, 0x11)
patch_byte(0x103b96fd3, 0x15)
patch_byte(0x108000000, 0x88)
patch_byte(0x108000001, 0x2)
patch_byte(0x108000002, 0x88)
patch_byte(0x108000003, 0x1a)
patch_byte(0x108000004, 0xe8)

[amimo]

I have the same requirement. I need to create a virtual code segment without file backend that can be used as codecave for binary patching.