feat: add relocation/rebasing tools for runtime-vs-static address mapping#451
feat: add relocation/rebasing tools for runtime-vs-static address mapping#45112UE wants to merge 1 commit into
Conversation
…ping Add api_relocation.py with tools for hybrid dynamic+static analysis: - calculate_relocation_delta: compute delta between IDA and runtime base - convert_ida_to_runtime: convert IDA address to debugger address - convert_runtime_to_ida: convert debugger address back to IDA address - set_relocation_base: permanently rebase IDB to match runtime Closes mrexodia#449
Relationship with existing
|
get_runtime_address_info |
New tools | |
|---|---|---|
| Direction | Runtime to IDA only | Both directions (IDA to Runtime and back) |
| Granularity | High-level, returns rich context (function name, xrefs, etc.) | Atomic / single-purpose operations |
| Use case | "Tell me everything about this runtime address" | Lightweight address arithmetic, batch conversions, rebasing |
| Mutates IDB | No | Only set_relocation_base does |
In short, get_runtime_address_info is a convenience tool for exploration, while the new tools provide the building blocks for programmatic workflows (e.g., scripting breakpoint lists, bulk address translation, or permanently syncing the IDB with a debugger session).
They complement rather than replace each other.
Self-review: Known LimitationsAfter reviewing my own code, here are a few minor points I'd like to flag for transparency: 1. Error reporting in result dictsWhen address parsing fails (e.g. invalid hex input), the tools return a zeroed result ( Potential improvement: class AddressConversionResult(TypedDict):
...
error: NotRequired[str] # populated only on failure2. Silent fallback in
|
Summary
Implements #449 ? adds relocation/rebasing tools for runtime-vs-static address mapping, enabling hybrid dynamic+static analysis with debuggers (x64dbg, x32dbg, WinDbg).
New Tools
calculate_relocation_deltaconvert_ida_to_runtimeconvert_runtime_to_idaset_relocation_base@idasync)Design Decisions
@idasync? they don't modify IDA state and can run without the main thread lockset_relocation_baseIS@idasync? it mutates the entire IDB viaidaapi.rebase_program()convert_ida_to_runtimeaccepts both hex addresses and symbol names viaparse_address()referencesfield in conversion results is populated when possible but never blocks on failureIntegration
One import added to
__init__.py:`python
from . import api_relocation
``n
Zero changes to existing APIs. Fully backward compatible.
Checklist
Closes #449