coolwanglu/scanmem — pull request #24 by sriemer (2014-05-06 06:16:09+00:00)
Title: introduce region type and load offset support

This patch set extends scanmem to determine the region type and the load offset of libraries and the executable. This information is displayed additionally in the `lregions` command. The default type is a single region `misc`. The single region types `heap` and `stack` are also easy to determine but `code` and `exe` are special:
`code` is a library or an executable which consists of 3 or 4 regions:
0: r,x - .text; 1: r - .rodata; 2: r,w - .data; 3: r,w - .bss
The regions 1, 2 and 3 are consecutive in memory (often even region 0 as well). This is how it can be determined that these regions belong together. The start of the .text region is used as the load offset of the binary. Subtracting it from a match address within the .data or .bss section results in the address used within the binary. This helps bypassing address space layout randomization (ASLR) in combination with position independent code (PIC) or position independent executable (PIE). The `list` command is extended to show that in an additionally displayed region info for found matches. The output format changes. So the GUI is changed as well. The `exe` type is a subtype of `code` and is just the executable.