How to determine the size when using get_content_from_virtual_address

[vegedreamgagnoa]

Any help/hint how to determine the exact size of code/instruction/bytes we obtain from a virtual address?
I was a little bit confused on determining the exact size when trying to fetch the bytes using get_content_from_virtual_address

Thank you for assistance.

[vegedreamgagnoa]

@codyd51

[codyd51]

Hi, thanks for your patience!

get_contents_from_virtual_address is a 'low-level' API, and doesn't automatically take into account the size of the underlying structure. If you know exactly what kind of structure you'd like to parse, you can use the read_struct API like so:

binary.read_struct(address, MachoSectionRawStruct, virtual=True)

That said, there are typically specific APIs to interact with the various structures in a Mach-O. For example, the above is better served by using the binary.sections API, which provides more information than parsing the structure by hand.

Please let me know if you have any other questions I can help with!