Strange behavior of MemEngine.map.

[Rubonnek]

Hello.

I was going through the Play with memory section in the Getting Started documentation and there's no mention of MemEngine.map which is necessary to run MemEngine.write against a certain address.

There's also a strange behavior with this map call -- is the following expected?

#!/usr/bin/env python3
import maat
maat_engine = maat.MaatEngine(maat.ARCH.X64, maat.OS.LINUX)

# Map 1(?) byte of memory
maat_engine.mem.map(0x100, 0x100, maat.MEM.RW)

# Write more than one byte to it
buf = b'I like turtles' * 100
maat_engine.mem.write(0x100, buf, len(buf))

# Can read it:
for i in range(0, len(buf)):
    address = 0x100 + i
    print("address: ", hex(address), " value: ", chr(maat_engine.mem.read(0x100 + i, 1).as_uint()))

It doesn't error out. I was expecting I would get an invalid memory write/read at any address other than 0x100, but I only get an error after trying to read over the 0xfff range.

[Boyan-MILANOV]

Hey!

there's no mention of MemEngine.map which is necessary to run MemEngine.write against a certain address

I agree that it wouldn't hurt mentioning the map() method there :)

There's also a strange behavior with this map call -- is the following expected?
[...]
It doesn't error out. I was expecting I would get an invalid memory write/read at any address other than 0x100, but I only get an error after trying to read over the 0xfff range.

It's expected. Maat manages memory access permissions at the page level, just like operating systems do. And the default page size is 0x1000. So when requesting a mapping that is smaller than a page, or overlaps between pages, Maat will always map the full pages (e.g map(0x800, 0x1200, ...) will result in both 0x0-0xfff and 0x1000-0x1fff pages being fully mapped.

Checking the python API documentation makes me realize that the page alignment isn't mentioned for map() and also that the doc is outdated and has new_segment() instead of map() 😅 I'll make sure to update the tutorial and the doc. Thanks for pointing this out!

[Rubonnek]

Makes sense.

Thank you for the clarification!