Re: [sarif] Question about locations

[Paul Anderson <paul@grammatech.com>]

Any more thoughts on this? Should I submit this as an issue?

Effective address is kind of a funny beast. It isn't quite a physical 
location, nor a logical one, at least IMHO. I agree that it is more on 
the physical end of the spectrum though.

-Paul


On 12/13/2018 12:42 PM, Larry Golding (Myriad Consulting Inc) wrote:
> Oh, I like that. Michael, what do you think?
>
> -----Original Message-----
> From: Paul Anderson <paul@grammatech.com>
> Sent: Thursday, December 13, 2018 9:38 AM
> To: Larry Golding (Myriad Consulting Inc) <v-lgold@microsoft.com>; sarif@lists.oasis-open.org
> Subject: Re: [sarif] Question about locations
>
> Larry:
>
>
> On 12/13/2018 12:30 PM, Larry Golding (Myriad Consulting Inc) wrote:
> > To specify an offset in a binary, you can use location.physicalLocation.region.byteOffset. Does that meet your need?
> Maybe, but I've been thinking of that as different. An effective address of X doesn't show up in a DLL at byte offset X.
> > If not, IMO we would add an "address" property to the physicalLocation object -- this is a physical, not a logical attribute.
> That would work. It would also allow you to move the address property out of the stack object down into the associated physicalLocation.
>
> -Paul
> > Larry
> >
> > -----Original Message-----
> > From: sarif@lists.oasis-open.org <sarif@lists.oasis-open.org> On
> > Behalf Of Paul Anderson
> > Sent: Thursday, December 13, 2018 9:23 AM
> > To: sarif@lists.oasis-open.org
> > Subject: [sarif] Question about locations
> >
> > All:
> >
> > Would it be an appropriate use of fullyQualifiedLogicalName to encode an effective address within a binary? I would use it with a kind of "address".
> >
> > I see that there is a slot in the stack object for an address, but that's the only place an address can show up. In my use case (static and dynamic analysis of binaries where the source is not available), I need to express locations in terms of their effective address.
> >
> > -Paul
> >
> > --
> > Paul Anderson, VP of Engineering, GrammaTech, Inc.
> > 531 Esty St., Ithaca, NY 14850
> > Tel: +1 607 273-7340 x118;
> > https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.g
> > rammatech.com&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C823297146aa
> > 14e6fed3b08d66121ab0c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636
> > 803194579286935&amp;sdata=aTM0TazhuB4thZu7dmsfeAdI6aE2NK9zpyLX8A0sS8E%
> > 3D&amp;reserved=0
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe from this mail list, you must leave the OASIS TC that
> > generates this mail.  Follow this link to all your TCs in OASIS at:
> > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.
> > oasis-open.org%2Fapps%2Forg%2Fworkgroup%2Fportal%2Fmy_workgroups.php&a
> > mp;data=02%7C01%7Cv-lgold%40microsoft.com%7C823297146aa14e6fed3b08d661
> > 21ab0c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636803194579286935
> > &amp;sdata=dRXsr3dd5MwnqZreylgMXoQvX7ditGSv5PdQL1%2BE8Ao%3D&amp;reserv
> > ed=0
> --
> Paul Anderson, VP of Engineering, GrammaTech, Inc.
> 531 Esty St., Ithaca, NY 14850
> Tel: +1 607 273-7340 x118; https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.grammatech.com&amp;data=02%7C01%7Cv-lgold%40microsoft.com%7C823297146aa14e6fed3b08d66121ab0c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636803194579286935&amp;sdata=aTM0TazhuB4thZu7dmsfeAdI6aE2NK9zpyLX8A0sS8E%3D&amp;reserved=0

--
Paul Anderson, VP of Engineering, GrammaTech, Inc.
531 Esty St., Ithaca, NY 14850
Tel: +1 607 273-7340 x118; http://www.grammatech.com