OK, I was under the impression for some reason that read_va = translate + read_pa when the length being read is less than a page. As for being lucky, I haven't seen this fail yet so thats _very_ lucky =)

----- Original message -----
> > @@ -271,6 +271,117 @@
> > }
> > 
> > status_t
> > +peparse_get_valid_pe_image(
> > +       vmi_instance_t vmi,
> > +       addr_t base_paddr,
> > +       size_t len,
> > +       const uint8_t * const image)
> > +{
> > +
> > +       uint32_t nbytes = vmi_read_pa(vmi, base_paddr, (void *)image,
> > len);
> 
> This is wrong and will fail sometimes.   You are trying to replace code
> that does a read_va with a translate + read_pa, but the logic isn't the
> same.   The read_va function handles reading at the virtual address
> level, even if the data structure doesn't appear on contiguous physical
> pages.   Since this is an OS-level data structure, this the correct
> abstraction to use.   Switch to the method you have here violates this
> abstraction.   And, if it works at all, it is only because you got lucky
> ;-)
> 
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/bdpayne/libvmi/pull/13/files#r2795596