public MachCoreKeyGenerator(ITracer tracer, SymbolStoreFile file) : base(tracer) { StreamAddressSpace dataSource = new StreamAddressSpace(file.Stream); _core = new MachCore(dataSource); }
public void CheckIndexingInfo() { using (Stream libcoreclr = TestUtilities.OpenCompressedFile("TestBinaries/libcoreclr.so.gz")) { StreamAddressSpace dataSource = new StreamAddressSpace(libcoreclr); ELFFile elf = new ELFFile(dataSource); Assert.True(elf.IsValid()); Assert.True(elf.Header.Type == ELFHeaderType.Shared); string buildId = TestUtilities.ToHexString(elf.BuildID); //this is the build id for libcoreclr.so from package: // https://dotnet.myget.org/feed/dotnet-core/package/nuget/runtime.ubuntu.14.04-x64.Microsoft.NETCore.Runtime.CoreCLR/2.0.0-preview3-25428-01 Assert.Equal("ef8f58a0b402d11c68f78342ef4fcc7d23798d4c", buildId); } // 32 bit arm ELF binary using (Stream apphost = TestUtilities.OpenCompressedFile("TestBinaries/apphost.gz")) { StreamAddressSpace dataSource = new StreamAddressSpace(apphost); ELFFile elf = new ELFFile(dataSource); Assert.True(elf.IsValid()); Assert.True(elf.Header.Type == ELFHeaderType.Executable); string buildId = TestUtilities.ToHexString(elf.BuildID); //this is the build id for apphost from package: // https://dotnet.myget.org/F/dotnet-core/symbols/runtime.linux-arm.Microsoft.NETCore.DotNetAppHost/2.1.0-preview2-25512-03 Assert.Equal("316d55471a8d5ebd6f2cb0631f0020518ab13dc0", buildId); } }
private static Minidump GetMinidumpFromStream(Stream stream) { IAddressSpace sas = new StreamAddressSpace(stream); Minidump minidump = new Minidump(sas); return(minidump); }
public string ComputeIndexKey(string path, Stream fileStream) { string extension = Path.GetExtension(path); if (extension != ".dll" && extension != ".exe") { return(null); } StreamAddressSpace fileAccess = new StreamAddressSpace(fileStream); try { PEFile reader = new PEFile(fileAccess); if (!reader.HasValidDosSignature.Check()) { return(null); } string filename = Path.GetFileName(path).ToLowerInvariant(); StringBuilder key = new StringBuilder(); key.Append(filename); key.Append("/"); key.Append(reader.Timestamp.ToString("x").ToLowerInvariant()); key.Append(reader.SizeOfImage.ToString("x").ToLowerInvariant()); key.Append("/"); key.Append(filename); return(key.ToString()); } catch (InputParsingException) { return(null); } }
public PDBFileKeyGenerator(ITracer tracer, SymbolStoreFile file) : base(tracer) { StreamAddressSpace dataSource = new StreamAddressSpace(file.Stream); _pdbFile = new PDBFile(dataSource); _path = file.FileName; }
public void CheckIndexingInfo() { using (Stream s = File.OpenRead("TestBinaries/HelloWorld.exe")) { StreamAddressSpace fileContent = new StreamAddressSpace(s); PEFile pe = new PEFile(fileContent); Assert.Equal((uint)0x8000, pe.SizeOfImage); Assert.Equal((uint)0x577F5919, pe.Timestamp); } }
public void CheckDwarfIndexingInfo() { //https://dotnet.myget.org/feed/dotnet-core/package/nuget/runtime.osx.10.10-x64.Microsoft.NETCore.Runtime.CoreCLR/1.0.2 using (FileStream dwarf = File.OpenRead("TestBinaries\\libcoreclr.dylib.dwarf")) { StreamAddressSpace dataSource = new StreamAddressSpace(dwarf); MachOFile machO = new MachOFile(dataSource); Assert.Equal(Guid.Parse("c988806d-a15d-5e3d-9a26-42cedad97a2f"), new Guid(machO.Uuid)); } }
public void CheckIndexingInfo() { // https://dotnet.myget.org/feed/dotnet-core/package/nuget/runtime.osx.10.12-x64.Microsoft.NETCore.Runtime.CoreCLR/1.1.2 using (Stream dylib = TestUtilities.OpenCompressedFile("TestBinaries/libcoreclr.dylib.gz")) { StreamAddressSpace dataSource = new StreamAddressSpace(dylib); MachOFile machO = new MachOFile(dataSource); Assert.True(machO.IsValid()); Assert.Equal(Guid.Parse("da2b37b5-cdbc-f838-899b-6a782ceca847"), new Guid(machO.Uuid)); } }
public void CheckDllIndexingInfo() { using (Stream s = File.OpenRead("TestBinaries/System.Diagnostics.StackTrace.dll")) { StreamAddressSpace fileContent = new StreamAddressSpace(s); PEFile pe = new PEFile(fileContent); Assert.True(pe.IsValid()); Assert.Equal((uint)0x35a00, pe.SizeOfImage); Assert.Equal((uint)0x595cd91b, pe.Timestamp); } }
public void CheckDwarfIndexingInfo() { // From a local build using (Stream dwarf = TestUtilities.OpenCompressedFile("TestBinaries/libclrjit.dylib.dwarf.gz")) { StreamAddressSpace dataSource = new StreamAddressSpace(dwarf); MachOFile machO = new MachOFile(dataSource); Assert.True(machO.IsValid()); Assert.Equal(Guid.Parse("0c235eb3-e98e-ef32-b6e6-e6ed18a604a8"), new Guid(machO.Uuid)); } }
public void ParseCore() { Stream core = GetCore(); StreamAddressSpace dataSource = new StreamAddressSpace(core); ELFCoreFile coreReader = new ELFCoreFile(dataSource); ELFLoadedImage loadedImage = coreReader.LoadedImages.Where(i => i.Path.EndsWith("librt-2.17.so")).First(); string buildId = string.Concat(loadedImage.Image.BuildID.Select(b => b.ToString("x2"))); Assert.Equal("1d2ad4eaa62bad560685a4b8dccc8d9aa95e22ce", buildId); }
public void CheckIndexingInfo() { using (Stream s = File.OpenRead("TestBinaries/HelloWorld.pdb")) { StreamAddressSpace fileContent = new StreamAddressSpace(s); PDBFile pdb = new PDBFile(fileContent); Assert.True(pdb.Header.IsMagicValid.Check()); Assert.Equal((uint)1, pdb.Age); Assert.Equal(Guid.Parse("99891B3E-D7AE-4C3B-ABFF-8A2B4A9B0C43"), pdb.Signature); } }
public void CheckCustomNamedBuildIdSection() { using (Stream stream = File.OpenRead("TestBinaries/renamed_build_id_section")) { StreamAddressSpace dataSource = new StreamAddressSpace(stream); ELFFile elf = new ELFFile(dataSource); Assert.True(elf.IsValid()); Assert.True(elf.Header.Type == ELFHeaderType.Shared); string buildId = TestUtilities.ToHexString(elf.BuildID); Assert.Equal("1bd6a199dcb6f234558d9439cfcbba2727f1e1d9", buildId); } }
public void CheckPdbInfo() { using (Stream s = File.OpenRead("TestBinaries/HelloWorld.exe")) { StreamAddressSpace fileContent = new StreamAddressSpace(s); PEFile pe = new PEFile(fileContent); PEPdbRecord pdb = pe.Pdb; Assert.Equal(Signature, pdb.Signature); Assert.Equal(Age, pdb.Age); Assert.Equal(Path, pdb.Path); } }
public void CheckFreeBSDIndexingInfo() { using (Stream stream = File.OpenRead("TestBinaries/ilasm.dbg")) { StreamAddressSpace dataSource = new StreamAddressSpace(stream); ELFFile elf = new ELFFile(dataSource); Assert.True(elf.IsValid()); Assert.True(elf.Header.Type == ELFHeaderType.Executable); string buildId = TestUtilities.ToHexString(elf.BuildID); Assert.Equal("4a91e41002a1307ef4097419d7875df001969daa", buildId); } }
public void CheckDbgIndexingInfo() { using (Stream stream = TestUtilities.OpenCompressedFile("TestBinaries/libcoreclrtraceptprovider.so.dbg.gz")) { StreamAddressSpace dataSource = new StreamAddressSpace(stream); ELFFile elf = new ELFFile(dataSource); Assert.True(elf.IsValid()); Assert.True(elf.Header.Type == ELFHeaderType.Shared); string buildId = TestUtilities.ToHexString(elf.BuildID); Assert.Equal("ce4ce0558d878a05754dff246ccea2a70a1db3a8", buildId); } }
public void CheckIndexingInfo() { using (FileStream libcoreclr = File.OpenRead("TestBinaries\\libcoreclr.so")) { StreamAddressSpace dataSource = new StreamAddressSpace(libcoreclr); ELFFile elf = new ELFFile(dataSource); string buildId = string.Concat(elf.BuildID.Select(b => b.ToString("x2"))); //this is the build id for libcoreclr.so from package: // https://dotnet.myget.org/feed/dotnet-core/package/nuget/runtime.ubuntu.14.04-x64.Microsoft.NETCore.Runtime.CoreCLR/1.0.2 Assert.Equal("bc0d85e535168f1a21a2dd79a466b3988bd274aa", buildId); } }
public void ParseCore() { using (FileStream core = File.OpenRead("TestBinaries\\core.12985")) { StreamAddressSpace dataSource = new StreamAddressSpace(core); // hard-coding the dylinker position so we don't pay to search for it each time // the code is capable of finding it by brute force search even if we don't provide the hint MachCore coreReader = new MachCore(dataSource, 0x00007fff68a59000); MachLoadedImage[] images = coreReader.LoadedImages.Where(i => i.Path.EndsWith("libcoreclr.dylib")).ToArray(); MachOFile libCoreclr = images[0].Image; Assert.Equal(Guid.Parse("c988806d-a15d-5e3d-9a26-42cedad97a2f"), new Guid(libCoreclr.Uuid)); } }
private static void CheckStartupMemoryRead(Stream stream) { IAddressSpace sas = new StreamAddressSpace(stream); MaxStreamReadHelper readHelper = new MaxStreamReadHelper(sas); Minidump minidump = new Minidump(readHelper); // We should have read the header of a minidump, so we cannot have read nothing. Assert.True(readHelper.Max > 0); // We should only read the header and not too far into the dump file, 1k should be plenty. Assert.True(readHelper.Max <= 1024); }
public void ParseTriageDump() { using (Stream core = TestUtilities.OpenCompressedFile("TestBinaries/triagedump.gz")) { StreamAddressSpace dataSource = new StreamAddressSpace(core); ELFCoreFile coreReader = new ELFCoreFile(dataSource); Assert.True(coreReader.IsValid()); ELFLoadedImage loadedImage = coreReader.LoadedImages.Where(i => i.Path.EndsWith("libcoreclr.so")).First(); Assert.True(loadedImage.Image.IsValid()); Assert.True(loadedImage.Image.Header.Type == ELFHeaderType.Shared); string buildId = TestUtilities.ToHexString(loadedImage.Image.BuildID); Assert.Equal("8f39a52a756311ab365090bfe9edef7ee8c44503", buildId); } }
public void ParseCore() { using (FileStream core = File.OpenRead("TestBinaries\\core")) { StreamAddressSpace dataSource = new StreamAddressSpace(core); ELFCoreFile coreReader = new ELFCoreFile(dataSource); ELFLoadedImage loadedImage = coreReader.LoadedImages.Where(i => i.Path.EndsWith("libcoreclr.so")).First(); string buildId = string.Concat(loadedImage.Image.BuildID.Select(b => b.ToString("x2"))); //this is the build id for libcoreclr.so from package: // https://dotnet.myget.org/feed/dotnet-core/package/nuget/runtime.ubuntu.14.04-x64.Microsoft.NETCore.Runtime.CoreCLR/1.0.2 Assert.Equal("bc0d85e535168f1a21a2dd79a466b3988bd274aa", buildId); } }
public void ParseCore() { using (Stream core = TestUtilities.OpenCompressedFile("TestBinaries/core.gz")) { StreamAddressSpace dataSource = new StreamAddressSpace(core); ELFCoreFile coreReader = new ELFCoreFile(dataSource); Assert.True(coreReader.IsValid()); ELFLoadedImage loadedImage = coreReader.LoadedImages.Where(i => i.Path.EndsWith("librt-2.17.so")).First(); Assert.True(loadedImage.Image.IsValid()); Assert.True(loadedImage.Image.Header.Type == ELFHeaderType.Shared); string buildId = TestUtilities.ToHexString(loadedImage.Image.BuildID); Assert.Equal("1d2ad4eaa62bad560685a4b8dccc8d9aa95e22ce", buildId); } }
public void ParseCore() { using (Stream core = TestUtilities.DecompressFile("TestBinaries/core.gz", "TestBinaries/core")) { StreamAddressSpace dataSource = new StreamAddressSpace(core); // hard-coding the dylinker position so we don't pay to search for it each time // the code is capable of finding it by brute force search even if we don't provide the hint MachCore coreReader = new MachCore(dataSource, 0x000000010750c000); Assert.True(coreReader.IsValid()); MachLoadedImage[] images = coreReader.LoadedImages.Where(i => i.Path.EndsWith("libcoreclr.dylib")).ToArray(); MachOFile libCoreclr = images[0].Image; Assert.True(libCoreclr.IsValid()); Assert.Equal(Guid.Parse("c5660f3e-7352-b138-8141-e9d63b8ab415"), new Guid(libCoreclr.Uuid)); } }
public void CheckExePdbInfo() { using (Stream s = File.OpenRead("TestBinaries/HelloWorld.exe")) { StreamAddressSpace fileContent = new StreamAddressSpace(s); PEFile pe = new PEFile(fileContent); // There should only be one pdb record entry foreach (PEPdbRecord pdb in pe.Pdbs) { Assert.Equal(new Guid("99891b3e-d7ae-4c3b-abff-8a2b4a9b0c43"), pdb.Signature); Assert.Equal(1, pdb.Age); Assert.Equal(@"c:\users\noahfalk\documents\visual studio 2015\Projects\HelloWorld\HelloWorld\obj\Debug\HelloWorld.pdb", pdb.Path); } } }
public IEnumerable <IDumpModule> GetDumpModules() { StreamAddressSpace dumpDataSource = new StreamAddressSpace(_dumpStream); Func <IAddressSpace, IEnumerable <IDumpModule> >[] parsers = new Func <IAddressSpace, IEnumerable <IDumpModule> >[] { TryParseMachODump }; foreach (var parser in parsers) { IEnumerable <IDumpModule> modules = parser(dumpDataSource); if (modules != null) { return(modules); } } throw new Exception("Dump did not match any supported format"); }
public void CheckDllPdbInfo() { using (Stream s = File.OpenRead("TestBinaries/System.Diagnostics.StackTrace.dll")) { StreamAddressSpace fileContent = new StreamAddressSpace(s); PEFile pe = new PEFile(fileContent); bool first = true; foreach (PEPdbRecord pdb in pe.Pdbs) { // Skip the first entry (ngen pdb) if (!first) { Assert.Equal(new Guid("8B2E8CF4-4314-4806-982A-B7D904876A50"), pdb.Signature); Assert.Equal(1, pdb.Age); Assert.Equal(@"/root/corefx/bin/obj/Unix.AnyCPU.Release/System.Diagnostics.StackTrace/netcoreapp/System.Diagnostics.StackTrace.pdb", pdb.Path); } first = false; } } }
private static bool TryGetPEIndex(Stream stream, out string uuid) { uuid = null; StreamAddressSpace fileAccess = new StreamAddressSpace(stream); try { PEFile reader = new PEFile(fileAccess); if (!reader.HasValidDosSignature.Check()) { return(false); } uuid = reader.Timestamp.ToString("x").ToLowerInvariant() + reader.SizeOfImage.ToString("x").ToLowerInvariant(); return(true); } catch (InputParsingException) { return(false); } }
internal override unsafe bool GetFileVersion(string dll, out int major, out int minor, out int revision, out int patch) { using FileStream stream = File.OpenRead(dll); StreamAddressSpace streamAddressSpace = new StreamAddressSpace(stream); Reader streamReader = new Reader(streamAddressSpace); ElfFile file = new ElfFile(streamReader); IElfHeader header = file.Header; ElfSectionHeader headerStringHeader = new ElfSectionHeader(streamReader, header.Is64Bit, header.SectionHeaderOffset + header.SectionHeaderStringIndex * header.SectionHeaderEntrySize); long headerStringOffset = (long)headerStringHeader.FileOffset; long dataOffset = 0; long dataSize = 0; for (int i = 0; i < header.SectionHeaderCount; i++) { if (i == header.SectionHeaderStringIndex) { continue; } ElfSectionHeader sectionHeader = new ElfSectionHeader(streamReader, header.Is64Bit, header.SectionHeaderOffset + i * header.SectionHeaderEntrySize); if (sectionHeader.Type == ElfSectionHeaderType.ProgBits) { string sectionName = streamReader.ReadNullTerminatedAscii(headerStringOffset + sectionHeader.NameIndex * sizeof(byte)); if (sectionName == ".data") { dataOffset = (long)sectionHeader.FileOffset; dataSize = (long)sectionHeader.FileSize; break; } } } DebugOnly.Assert(dataOffset != 0); DebugOnly.Assert(dataSize != 0); Span <byte> buffer = stackalloc byte[s_versionLength]; long address = dataOffset; long endAddress = address + dataSize; while (address < endAddress) { int read = streamAddressSpace.Read(address, buffer); if (read < s_versionLength) { break; } if (!buffer.SequenceEqual(s_versionString)) { address++; continue; } address += s_versionLength; // TODO: This should be cleaned up to not read byte by byte in the future. Leaving it here // until we decide whether to rewrite the Linux coredumpreader or not. StringBuilder builder = new StringBuilder(); while (address < endAddress) { Span <byte> bytes = stackalloc byte[1]; read = streamAddressSpace.Read(address, bytes); if (read < bytes.Length) { break; } if (bytes[0] == '\0') { break; } if (bytes[0] == ' ') { try { Version v = Version.Parse(builder.ToString()); major = v.Major; minor = v.Minor; revision = v.Build; patch = v.Revision; return(true); } catch (FormatException) { break; } } Span <char> chars = stackalloc char[1]; fixed(byte *bytesPtr = &MemoryMarshal.GetReference(bytes)) fixed(char *charsPtr = &MemoryMarshal.GetReference(chars)) { _ = Encoding.ASCII.GetChars(bytesPtr, bytes.Length, charsPtr, chars.Length); } _ = builder.Append(chars[0]); address++; } break; } major = minor = revision = patch = 0; return(false); }
internal void VerifyCoreDump() { foreach (string inputFile in GetInputFiles()) { Console.WriteLine($"{inputFile}"); using Stream inputStream = File.Open(inputFile, FileMode.Open, FileAccess.Read, FileShare.Read); var dataSource = new StreamAddressSpace(inputStream); var core = new ELFCoreFile(dataSource); if (Tracer.Enabled) { foreach (ELFProgramSegment segment in core.Segments) { Tracer.Information("{0:X16}-{1:X16} {2:X8} {3:X8} {4}", segment.Header.VirtualAddress.Value, segment.Header.VirtualAddress + segment.Header.VirtualSize, segment.Header.FileOffset.Value, (ulong)segment.Header.FileSize, segment.Header.Type); } } foreach (ELFLoadedImage image in core.LoadedImages) { Console.WriteLine("{0:X16} {1}", image.LoadAddress, image.Path); Exception elfException = null; Exception machoException = null; Exception peException = null; try { ELFFile elfFile = image.Image; if (elfFile.IsValid()) { try { byte[] buildid = elfFile.BuildID; } catch (Exception ex) { Console.WriteLine(" ELF file invalid build id - {0}", ex.Message); } foreach (ELFProgramSegment segment in elfFile.Segments) { Tracer.Verbose(" {0:X16}-{1:X16} file off {2:X8} file size {3:X8} {4}", segment.Header.VirtualAddress.Value, segment.Header.VirtualAddress + segment.Header.VirtualSize, segment.Header.FileOffset.Value, (ulong)segment.Header.FileSize, segment.Header.Type); if (segment.Header.Type == ELFProgramHeaderType.Note || segment.Header.Type == ELFProgramHeaderType.Dynamic || segment.Header.Type == ELFProgramHeaderType.GnuEHFrame) { try { byte[] data = segment.Contents.Read(0, (uint)segment.Header.VirtualSize); } catch (Exception ex) { Console.WriteLine(" ELF file segment {0} virt addr {1:X16} virt size {2:X8} INVALID - {3}", segment.Header.Type, segment.Header.VirtualAddress, segment.Header.VirtualSize, ex.Message); } } } // The ELF module was valid try next module continue; } } catch (Exception ex) { elfException = ex; } IAddressSpace addressSpace = new RelativeAddressSpace(core.DataSource, image.LoadAddress, core.DataSource.Length); try { var machoFile = new MachOFile(addressSpace); if (machoFile.IsValid()) { try { byte[] uuid = machoFile.Uuid; } catch (Exception ex) { Console.WriteLine(" MachO file invalid uuid - {0}", ex.Message); } foreach (MachSegment segment in machoFile.Segments) { Tracer.Verbose(" {0:X16}-{1:X16} offset {2:X16} size {3:X16} {4} {5}", (ulong)segment.LoadCommand.VMAddress, segment.LoadCommand.VMAddress + segment.LoadCommand.VMSize, (ulong)segment.LoadCommand.FileOffset, (ulong)segment.LoadCommand.FileSize, segment.LoadCommand.Command, segment.LoadCommand.SegName); foreach (MachSection section in segment.Sections) { Tracer.Verbose(" addr {0:X16} size {1:X16} offset {2:X8} {3}", (ulong)section.Address, (ulong)section.Size, section.Offset, section.SectionName); } } // The MachO module was valid try next module continue; } } catch (Exception ex) { machoException = ex; } try { var peFile = new PEFile(addressSpace, true); if (peFile.IsValid()) { // The PE module was valid try next module continue; } } catch (Exception ex) { peException = ex; } Console.WriteLine("{0:X16} invalid image - {1}", image.LoadAddress, image.Path); if (elfException != null) { Tracer.Verbose("ELF {0}", elfException.Message); } if (machoException != null) { Tracer.Verbose("MachO {0}", machoException.Message); } if (peException != null) { Tracer.Verbose("PE {0}", peException.Message); } } ulong segmentsTotal = core.Segments.Max(s => s.Header.FileOffset + s.Header.FileSize); if (segmentsTotal > dataSource.Length) { Console.WriteLine($"ERROR: Core file not complete: file size 0x{dataSource.Length:X8} segments total 0x{segmentsTotal:X8}"); } } }