On Mon, 10 Mar 2014 21:38:31 +0100, Mark Wielaard wrote:
On Thu, 2014-03-06 at 20:55 +0100, Jan Kratochvil wrote:
> In general I believe reading /proc/PID/maps is safer than the guessing by
> elf_from_remote_memory(), for example because the image may come from mmap()
> and not from dlopen(). But I guess it may be the common disagreement.
I agree that using all addresses from /proc/PID/maps, and not just the
base address, would be a good idea. But IMHO elf_from_remote_memory
should still be used for sanity checking the segment mapping addresses
and offsets to make sure the ELF file was mapped in as expected.
I was not against the part of sanity checks at all.
Jan