Skip to content

Instantly share code, notes, and snippets.

@ChadSki
Created May 27, 2014 17:56
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ChadSki/caab4761d0457548eef1 to your computer and use it in GitHub Desktop.
Save ChadSki/caab4761d0457548eef1 to your computer and use it in GitHub Desktop.
How to map magic
if location == 'file':
# Usually the tag index directly follows the index header. However,
# some forms of map protection move the tag index to other locations.
index_offset = map_header.index_offset + index_header.primary_magic - 0x40440000
# On disk, we need to use a magic value to convert pointers into file offsets.
# The magic value is based on the index location within the file, since this
# always appears at the same place in memory.
map_magic = index_header.primary_magic - index_offset
elif location == 'mem':
# Almost always 0x40440028, unless the map has been protected in a specific way.
index_offset = index_header.primary_magic
# In memory, offsets are just raw pointers and require no adjustment.
map_magic = 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment