public void SeveralNtFiles()
{
var StartAddresss = new ulong[] { expectedStartAddress, anotherExpectedStartAddress };
var offsets = new ulong[] { expectedOffset, expectedOffset };
var EndAddresss = new ulong[] { expectedEndAddress, anotherExpectedEndAddress };
var names = new string[] { expectedName, anotherExpectedName };
var ntFiles = TestData.GetNtFileSectionsBytes(StartAddresss, EndAddresss, offsets, names);
var noteBytes =
TestData.GetNoteSectionBytes(NoteSection.CoreName, NoteSection.NtFileType, ntFiles);
var fileReader = new BinaryReader(new MemoryStream(noteBytes));
var sections = NoteSection.ReadModuleSections(fileReader, ntFiles.Length).ToArray();
Assert.AreEqual(2, sections.Length);
var first = sections.First();
Assert.AreEqual(expectedEndAddress, first.EndAddress);
Assert.AreEqual(expectedStartAddress, first.StartAddress);
Assert.AreEqual(expectedName, first.Path);
var last = sections.Last();
Assert.AreEqual(anotherExpectedEndAddress, last.EndAddress);
Assert.AreEqual(anotherExpectedStartAddress, last.StartAddress);
Assert.AreEqual(anotherExpectedName, last.Path);
}
public void ShortNoteStream()
{
var minNote = TestData.GetNoteSectionBytes("", 0, new byte[0]);
var notEnoughBytes = minNote.Skip(1).ToArray();
var emptyReader = new BinaryReader(new MemoryStream(notEnoughBytes));
var sections = NoteSection.ReadModuleSections(emptyReader, minNote.Length).ToArray();
Assert.AreEqual(0, sections.Length);
}
public void WrongNtFileType()
{
var ntFile = GetExpectedNtFileBytes();
var noteBytes = TestData.GetNoteSectionBytes(NoteSection.CoreName, 0, ntFile);
var fileReader = new BinaryReader(new MemoryStream(noteBytes));
var sections = NoteSection.ReadModuleSections(fileReader, ntFile.Length).ToArray();
Assert.AreEqual(0, sections.Length);
}
public void WrongIdNoteType()
{
var noteBytes = TestData.GetNoteSectionBytes(
NoteSection.GnuName, NoteSection.NtFileType, TestData.expectedId.Bytes.ToArray());
var reader = new BinaryReader(new MemoryStream(noteBytes));
var buildId = NoteSection.ReadBuildId(reader, noteBytes.Length);
Assert.AreEqual(BuildId.Empty, buildId);
}
// This test is checking a dump with the following structure:
// Start position Section description Section size in bytes
// 0 Dump elf header 64
// 64 Program headers --
// 64 File index note program header 56
// 120 File1 header 56
// 176 File2 header 56
// 232 File1 contents 156
// 388 File index note 104
// 484 File2 contents 156
TestDumpFile CreateValidDumpFile()
{
ushort programHeadersCount = 3;
byte[] elfHeaderBytes = TestData.GetElfBytes(ElfHeader.Size, ProgramHeader.Size,
programHeadersCount, false);
byte[] file1Bytes = TestData.GetElfFileBytesFromBuildId(TestData.expectedId);
ulong file1Offset =
(ulong)elfHeaderBytes.Length + programHeadersCount * (ulong)ProgramHeader.Size;
ulong file1Size = (ulong)file1Bytes.Length;
ulong file1Address = 1000;
byte[] file2Bytes = TestData.GetElfFileBytesFromBuildId(TestData.anotherExpectedId);
ulong file2Offset = 484;
ulong file2Size = (ulong)file2Bytes.Length;
ulong file2Address = 2000;
ulong fileIndexOffset = file1Offset + file1Size;
byte[] fileIndexBytes = TestData.GetNtFileSectionsBytes(
new[] { file1Address, file2Address },
new[] { file1Address + file1Size, file2Address + file2Size }, new[] { 0ul, 0ul },
new[] { expectedFileName, anotherExpectedFileName });
byte[] fileIndexNoteBytes = TestData.GetNoteSectionBytes(
NoteSection.CoreName, NoteSection.NtFileType, fileIndexBytes);
byte[] fileIndexHeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.NoteSegment, fileIndexOffset, 0ul /* address */,
(ulong)(fileIndexNoteBytes.Length));
byte[] file1HeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.LoadableSegment, file1Offset, file1Address, file1Size);
byte[] file2HeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.LoadableSegment, file2Offset, file2Address, file2Size);
byte[] headers = elfHeaderBytes.Concat(fileIndexHeaderBytes)
.Concat(file1HeaderBytes)
.Concat(file2HeaderBytes)
.ToArray();
Assert.That(file2Offset,
Is.EqualTo(fileIndexOffset + (ulong)fileIndexNoteBytes.Length));
return(new TestDumpFile {
NoteNtFileEnd = file2Offset,
Bytes = headers.Concat(file1Bytes)
.Concat(fileIndexNoteBytes)
.Concat(file2Bytes)
.ToArray(),
});
}
public void ManySectionsInBinaryFile()
{
// This test is checking a dump with the structure below. The elf module file in the
// dump contains many sections to test that the code that looks for build ID can
// find build IDs far in the file.
//
// Start position Section name Section size in bytes
// 0 Dump elf header 64
// 64 Program headers --
// 64 File index note program header 56
// 120 File header 56
// 176 File contents 8156
// 8332 File index 68
ushort programHeadersCount = 2;
byte[] elfHeaderBytes = TestData.GetElfBytes(ElfHeader.Size, ProgramHeader.Size,
programHeadersCount, false);
byte[] fileBytes = GetElfFileBytesWithManySections(TestData.expectedId);
ulong fileOffset =
(ulong)elfHeaderBytes.Length + programHeadersCount * (ulong)ProgramHeader.Size;
ulong fileSize = (ulong)fileBytes.Length;
ulong fileAddress = 1000;
ulong fileIndexOffset = fileOffset + fileSize;
byte[] fileIndexBytes = TestData.GetNtFileSectionBytes(
fileAddress, fileAddress + fileSize, 0ul, expectedFileName);
byte[] fileIndexNoteBytes = TestData.GetNoteSectionBytes(
NoteSection.CoreName, NoteSection.NtFileType, fileIndexBytes);
byte[] fileIndexHeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.NoteSegment, fileIndexOffset, 0ul /* address */,
(ulong)(fileIndexNoteBytes.Length));
byte[] fileHeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.LoadableSegment, fileOffset, fileAddress, fileSize);
byte[] headers =
elfHeaderBytes.Concat(fileIndexHeaderBytes).Concat(fileHeaderBytes).ToArray();
byte[] dumpFileBytes = headers.Concat(fileBytes).Concat(fileIndexNoteBytes).ToArray();
_fileSystem.AddFile(dumpPath, new MockFileData(dumpFileBytes));
DumpReadResult dump = _provider.GetModules(dumpPath);
Assert.That(dump.Warning, Is.EqualTo(DumpReadWarning.None));
Assert.That(dump.Modules.Count(), Is.EqualTo(1));
Assert.That(dump.Modules.ElementAt(0).Path, Is.EqualTo(expectedFileName));
Assert.That(dump.Modules.ElementAt(0).Id, Is.EqualTo(TestData.expectedId));
}
public void CorrectNtFileNote()
{
var ntFile = GetExpectedNtFileBytes();
var noteBytes =
TestData.GetNoteSectionBytes(NoteSection.CoreName, NoteSection.NtFileType, ntFile);
var fileReader = new BinaryReader(new MemoryStream(noteBytes));
var sections = NoteSection.ReadModuleSections(fileReader, ntFile.Length).ToArray();
Assert.AreEqual(1, sections.Length);
var section = sections.First();
Assert.AreEqual(expectedEndAddress, section.EndAddress);
Assert.AreEqual(expectedStartAddress, section.StartAddress);
Assert.AreEqual(expectedName, section.Path);
}
// This creates an ELF file with a hundred dummy note sections preceding the build ID
// section.
public static byte[] GetElfFileBytesWithManySections(BuildId id)
{
byte[] idNote = TestData.GetNoteSectionBytes(
NoteSection.GnuName, NoteSection.NtGnuBuildIdType, id.Bytes.ToArray());
byte[] dummyNote = TestData.GetNoteSectionBytes("dummy", 1234, new byte[1]);
ushort dummySectionCount = 100;
ushort sectionCount = (ushort)(dummySectionCount + 1);
var contents = new System.Collections.Generic.List <byte>();
// Add the elf header.
contents.AddRange(
TestData.GetElfBytes(ElfHeader.Size, ProgramHeader.Size, sectionCount, false));
// Add program headers.
for (ulong i = 0; i < dummySectionCount; i++)
{
ulong dummyNoteOffset = ElfHeader.Size + sectionCount * (ulong)ProgramHeader.Size +
i * (ulong)dummyNote.Length;
contents.AddRange(TestData.GetProgramHeaderBytes(
ProgramHeader.Type.NoteSegment, dummyNoteOffset, 0, (ulong)dummyNote.Length));
}
var noteOffset = ElfHeader.Size + sectionCount * (ulong)ProgramHeader.Size +
dummySectionCount * (ulong)dummyNote.Length;
contents.AddRange(TestData.GetProgramHeaderBytes(ProgramHeader.Type.NoteSegment,
noteOffset, 0, (ulong)idNote.Length));
// Add the sections.
for (ulong i = 0; i < dummySectionCount; i++)
{
contents.AddRange(dummyNote);
}
contents.AddRange(idNote);
return(contents.ToArray());
}
public void NtFileWithSeveralLocations()
{
var StartAddresss = new ulong[] { expectedStartAddress + 1, expectedStartAddress };
var offsets = new ulong[] { expectedOffset + 1, expectedOffset };
var EndAddresss = new ulong[] { expectedEndAddress + 1, expectedEndAddress };
var names = new string[] { expectedName, expectedName };
var ntFile = TestData.GetNtFileSectionsBytes(StartAddresss, EndAddresss, offsets,
names);
var noteBytes =
TestData.GetNoteSectionBytes(NoteSection.CoreName, NoteSection.NtFileType, ntFile);
var fileReader = new BinaryReader(new MemoryStream(noteBytes));
var sections = NoteSection.ReadModuleSections(fileReader, ntFile.Length).ToArray();
Assert.AreEqual(1, sections.Length);
var section = sections.First();
Assert.AreEqual(expectedEndAddress, section.EndAddress);
Assert.AreEqual(expectedStartAddress, section.StartAddress);
Assert.AreEqual(expectedName, section.Path);
}
public void SeveralNtFilesNotes()
{
var firstNtFilesSection = GetExpectedNtFileBytes();
var firstNoteBytes = TestData.GetNoteSectionBytes(
NoteSection.CoreName, NoteSection.NtFileType, firstNtFilesSection);
var wrongNtFilesSection = GetExpectedNtFileBytes();
var wrongNoteBytes = TestData.GetNoteSectionBytes(
NoteSection.GnuName, NoteSection.NtFileType, wrongNtFilesSection);
var secondNtFileSection = TestData.GetNtFileSectionBytes(
anotherExpectedStartAddress, anotherExpectedEndAddress, expectedOffset,
anotherExpectedName);
var secondNoteBytes = TestData.GetNoteSectionBytes(
NoteSection.CoreName, NoteSection.NtFileType, secondNtFileSection);
var fullNoteBytes = firstNoteBytes.Concat(wrongNoteBytes).Concat(secondNoteBytes)
.ToArray();
var fileReader = new BinaryReader(new MemoryStream(fullNoteBytes));
var sections = NoteSection.ReadModuleSections(fileReader, fullNoteBytes.Length).ToArray();
Assert.AreEqual(2, sections.Length);
var first = sections.First();
Assert.AreEqual(expectedEndAddress, first.EndAddress);
Assert.AreEqual(expectedStartAddress, first.StartAddress);
Assert.AreEqual(expectedName, first.Path);
var last = sections.Last();
Assert.AreEqual(anotherExpectedEndAddress, last.EndAddress);
Assert.AreEqual(anotherExpectedStartAddress, last.StartAddress);
Assert.AreEqual(anotherExpectedName, last.Path);
}
public void CorrectModules()
{
ushort programHeadersCount = 4;
var elfHeaderBytes = TestData.GetElfBytes(ElfHeader.Size, ProgramHeader.Size,
programHeadersCount, false);
ulong firstFileOffset = ElfHeader.Size +
(ulong)programHeadersCount * ProgramHeader.Size;
var firstFileBytes = TestData.GetElfFileBytesFromBuildId(TestData.expectedId);
var secondFileBytes = TestData.GetElfFileBytesFromBuildId(TestData.anotherExpectedId);
var firstFileHeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.LoadableSegment, firstFileOffset, firstFileOffset,
(ulong)firstFileBytes.Length);
var firstFileIndexOffset = firstFileOffset + (ulong)firstFileBytes.Length;
var fileIndexBytes = TestData.GetNtFileSectionBytes(
firstFileOffset, firstFileIndexOffset, 0ul, expectedFileName);
var firstFileIndexNoteBytes = TestData.GetNoteSectionBytes(
NoteSection.CoreName, NoteSection.NtFileType, fileIndexBytes);
var firstFileIndexHeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.NoteSegment, firstFileIndexOffset, firstFileIndexOffset,
(ulong)firstFileBytes.Length);
ulong secondFileIndexOffset = firstFileIndexOffset +
(ulong)firstFileIndexNoteBytes.Length;
ulong secondFileOffset = secondFileIndexOffset + (ulong)firstFileIndexNoteBytes.Length;
ulong secondFileDataEnd = secondFileOffset + (ulong)secondFileBytes.Length;
var secondIndexBytes = TestData.GetNtFileSectionBytes(
secondFileOffset, secondFileDataEnd, 0ul, anotherExpectedFileName);
var secondFileIndexHeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.NoteSegment, secondFileIndexOffset, secondFileIndexOffset,
(ulong)secondIndexBytes.Length);
var secondFileIndexNoteBytes = TestData.GetNoteSectionBytes(
NoteSection.CoreName, NoteSection.NtFileType, secondIndexBytes);
var secondFileHeaderBytes = TestData.GetProgramHeaderBytes(
ProgramHeader.Type.LoadableSegment, secondFileOffset, secondFileOffset,
(ulong)secondFileBytes.Length);
var dumpBytes = elfHeaderBytes.Concat(firstFileHeaderBytes)
.Concat(firstFileIndexHeaderBytes).Concat(secondFileIndexHeaderBytes)
.Concat(secondFileHeaderBytes).Concat(firstFileBytes)
.Concat(firstFileIndexNoteBytes).Concat(secondFileIndexNoteBytes)
.Concat(secondFileBytes).ToArray();
_fileSystem.AddFile(dumpPath, new MockFileData(dumpBytes));
DumpReadResult dump = _provider.GetModules(dumpPath);
Assert.AreEqual(2, dump.Modules.Count());
var firstModule = dump.Modules.First();
Assert.AreEqual(expectedFileName, firstModule.Path);
Assert.AreEqual(TestData.expectedId, firstModule.Id);
var lastModule = dump.Modules.Last();
Assert.AreEqual(anotherExpectedFileName, lastModule.Path);
Assert.AreEqual(TestData.anotherExpectedId, lastModule.Id);
}