public ELFCoreKeyGenerator(ITracer tracer, SymbolStoreFile file)
: base(tracer)
{
StreamAddressSpace dataSource = new StreamAddressSpace(file.Stream);
_core = new ELFCoreFile(dataSource);
}
public void ParseCore()
{
Stream core = GetCore();
StreamAddressSpace dataSource = new StreamAddressSpace(core);
ELFCoreFile coreReader = new ELFCoreFile(dataSource);
ELFLoadedImage loadedImage = coreReader.LoadedImages.Where(i => i.Path.EndsWith("librt-2.17.so")).First();
string buildId = string.Concat(loadedImage.Image.BuildID.Select(b => b.ToString("x2")));
Assert.Equal("1d2ad4eaa62bad560685a4b8dccc8d9aa95e22ce", buildId);
}
public void ParseCore()
{
using (Stream core = TestUtilities.OpenCompressedFile("TestBinaries/core.gz"))
{
StreamAddressSpace dataSource = new StreamAddressSpace(core);
ELFCoreFile coreReader = new ELFCoreFile(dataSource);
Assert.True(coreReader.IsValid());
ELFLoadedImage loadedImage = coreReader.LoadedImages.Where(i => i.Path.EndsWith("librt-2.17.so")).First();
Assert.True(loadedImage.Image.IsValid());
Assert.True(loadedImage.Image.Header.Type == ELFHeaderType.Shared);
string buildId = TestUtilities.ToHexString(loadedImage.Image.BuildID);
Assert.Equal("1d2ad4eaa62bad560685a4b8dccc8d9aa95e22ce", buildId);
}
}
public void ParseTriageDump()
{
using (Stream core = TestUtilities.OpenCompressedFile("TestBinaries/triagedump.gz"))
{
StreamAddressSpace dataSource = new StreamAddressSpace(core);
ELFCoreFile coreReader = new ELFCoreFile(dataSource);
Assert.True(coreReader.IsValid());
ELFLoadedImage loadedImage = coreReader.LoadedImages.Where(i => i.Path.EndsWith("libcoreclr.so")).First();
Assert.True(loadedImage.Image.IsValid());
Assert.True(loadedImage.Image.Header.Type == ELFHeaderType.Shared);
string buildId = TestUtilities.ToHexString(loadedImage.Image.BuildID);
Assert.Equal("8f39a52a756311ab365090bfe9edef7ee8c44503", buildId);
}
}
public void ParseCore()
{
using (FileStream core = File.OpenRead("TestBinaries\\core"))
{
StreamAddressSpace dataSource = new StreamAddressSpace(core);
ELFCoreFile coreReader = new ELFCoreFile(dataSource);
ELFLoadedImage loadedImage = coreReader.LoadedImages.Where(i => i.Path.EndsWith("libcoreclr.so")).First();
string buildId = string.Concat(loadedImage.Image.BuildID.Select(b => b.ToString("x2")));
//this is the build id for libcoreclr.so from package:
// https://dotnet.myget.org/feed/dotnet-core/package/nuget/runtime.ubuntu.14.04-x64.Microsoft.NETCore.Runtime.CoreCLR/1.0.2
Assert.Equal("bc0d85e535168f1a21a2dd79a466b3988bd274aa", buildId);
}
}
private bool IsELFCore(Stream decompressed)
{
try
{
var coreFile = new ELFCoreFile(new StreamAddressSpace(decompressed));
//get this property so that it will force the validation of the file format before we allocate anything else
var fileTable = coreFile.FileTable;
_fileFormatReader = coreFile;
return(true);
}
catch
{
return(false);
}
}
internal void VerifyCoreDump()
{
foreach (string inputFile in GetInputFiles())
{
Console.WriteLine($"{inputFile}");
using Stream inputStream = File.Open(inputFile, FileMode.Open, FileAccess.Read, FileShare.Read);
var dataSource = new StreamAddressSpace(inputStream);
var core = new ELFCoreFile(dataSource);
if (Tracer.Enabled)
{
foreach (ELFProgramSegment segment in core.Segments)
{
Tracer.Information("{0:X16}-{1:X16} {2:X8} {3:X8} {4}",
segment.Header.VirtualAddress.Value,
segment.Header.VirtualAddress + segment.Header.VirtualSize,
segment.Header.FileOffset.Value,
(ulong)segment.Header.FileSize,
segment.Header.Type);
}
}
foreach (ELFLoadedImage image in core.LoadedImages)
{
Console.WriteLine("{0:X16} {1}", image.LoadAddress, image.Path);
Exception elfException = null;
Exception machoException = null;
Exception peException = null;
try
{
ELFFile elfFile = image.Image;
if (elfFile.IsValid())
{
try
{
byte[] buildid = elfFile.BuildID;
}
catch (Exception ex)
{
Console.WriteLine(" ELF file invalid build id - {0}", ex.Message);
}
foreach (ELFProgramSegment segment in elfFile.Segments)
{
Tracer.Verbose(" {0:X16}-{1:X16} file off {2:X8} file size {3:X8} {4}",
segment.Header.VirtualAddress.Value,
segment.Header.VirtualAddress + segment.Header.VirtualSize,
segment.Header.FileOffset.Value,
(ulong)segment.Header.FileSize,
segment.Header.Type);
if (segment.Header.Type == ELFProgramHeaderType.Note ||
segment.Header.Type == ELFProgramHeaderType.Dynamic ||
segment.Header.Type == ELFProgramHeaderType.GnuEHFrame)
{
try
{
byte[] data = segment.Contents.Read(0, (uint)segment.Header.VirtualSize);
}
catch (Exception ex)
{
Console.WriteLine(" ELF file segment {0} virt addr {1:X16} virt size {2:X8} INVALID - {3}",
segment.Header.Type, segment.Header.VirtualAddress, segment.Header.VirtualSize, ex.Message);
}
}
}
// The ELF module was valid try next module
continue;
}
}
catch (Exception ex)
{
elfException = ex;
}
IAddressSpace addressSpace = new RelativeAddressSpace(core.DataSource, image.LoadAddress, core.DataSource.Length);
try
{
var machoFile = new MachOFile(addressSpace);
if (machoFile.IsValid())
{
try
{
byte[] uuid = machoFile.Uuid;
}
catch (Exception ex)
{
Console.WriteLine(" MachO file invalid uuid - {0}", ex.Message);
}
foreach (MachSegment segment in machoFile.Segments)
{
Tracer.Verbose(" {0:X16}-{1:X16} offset {2:X16} size {3:X16} {4} {5}",
(ulong)segment.LoadCommand.VMAddress,
segment.LoadCommand.VMAddress + segment.LoadCommand.VMSize,
(ulong)segment.LoadCommand.FileOffset,
(ulong)segment.LoadCommand.FileSize,
segment.LoadCommand.Command,
segment.LoadCommand.SegName);
foreach (MachSection section in segment.Sections)
{
Tracer.Verbose(" addr {0:X16} size {1:X16} offset {2:X8} {3}",
(ulong)section.Address,
(ulong)section.Size,
section.Offset,
section.SectionName);
}
}
// The MachO module was valid try next module
continue;
}
}
catch (Exception ex)
{
machoException = ex;
}
try
{
var peFile = new PEFile(addressSpace, true);
if (peFile.IsValid())
{
// The PE module was valid try next module
continue;
}
}
catch (Exception ex)
{
peException = ex;
}
Console.WriteLine("{0:X16} invalid image - {1}", image.LoadAddress, image.Path);
if (elfException != null)
{
Tracer.Verbose("ELF {0}", elfException.Message);
}
if (machoException != null)
{
Tracer.Verbose("MachO {0}", machoException.Message);
}
if (peException != null)
{
Tracer.Verbose("PE {0}", peException.Message);
}
}
ulong segmentsTotal = core.Segments.Max(s => s.Header.FileOffset + s.Header.FileSize);
if (segmentsTotal > dataSource.Length)
{
Console.WriteLine($"ERROR: Core file not complete: file size 0x{dataSource.Length:X8} segments total 0x{segmentsTotal:X8}");
}
}
}
