map_native_address
Maps module-relative addresses to local ELF PT_LOAD segments for Ghidra/REA follow-up, requiring page size; reports runtime address, RVA, virtual address, file offset; digest verifies identity.
Instructions
Map an observed module-relative address into an explicit local ELF’s PT_LOAD segments for REA/Ghidra follow-up. Requires the target page size. Reports separate runtime address, module RVA, ELF virtual address and possible file offset. File identity remains unverified unless the caller supplies a matching runtime artifact digest.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| page_size | Yes | ||
| module_base | Yes | ||
| expected_sha256 | No | ||
| runtime_address | Yes | ||
| ghidra_image_base | No | ||
| analysis_project_id | No | Optional investigation to retain this tool result in. Does not prove target identity or causal relationships. | |
| normalize_thumb_pointer | No |