/// <summary>
/// Parses frame description from the specified data memory reader.
/// </summary>
/// <param name="data">The data memory reader.</param>
/// <param name="entry">Common information entry for parsed frame description.</param>
/// <param name="endPosition">Position in the data reader where parsed frame description ends.</param>
/// <param name="input">The input data for parsing configuration.</param>
/// <returns>Parsed frame description.</returns>
private static DwarfFrameDescriptionEntry ParseDescription(DwarfMemoryReader data, DwarfExceptionHandlingCommonInformationEntry entry, int endPosition, DwarfExceptionHandlingFrameParsingInput input)
{
DwarfFrameDescriptionEntry description = new DwarfFrameDescriptionEntry();
description.InitialLocation = ReadEncodedAddress(data, entry.FrameDescriptionAddressEncoding, input);
description.AddressRange = ReadEncodedAddress(data, entry.FrameDescriptionAddressEncoding & DwarfExceptionHandlingEncoding.Mask, input);
description.CommonInformationEntry = entry;
int instructionsStart = -1;
if (entry.Augmentation.Length >= 1 && entry.Augmentation[0] == 'z')
{
uint length = data.LEB128();
instructionsStart = data.Position + (int)length;
if (entry.LanguageSpecificDataAreaEncoding != DwarfExceptionHandlingEncoding.Omit)
{
ulong lsdaDataFileAddress = ReadEncodedAddress(data, entry.LanguageSpecificDataAreaEncoding, input);
}
}
if (instructionsStart >= 0)
{
data.Position = instructionsStart;
}
description.Instructions = data.ReadBlock((uint)(endPosition - data.Position));
return(description);
}
/// <summary>
/// Parses the data for this instance.
/// </summary>
/// <param name="data">The data memory reader.</param>
/// <param name="defaultAddressSize">Default size of the address.</param>
/// <param name="endPosition">The end position.</param>
private void ParseData(DwarfMemoryReader data, byte defaultAddressSize, int endPosition)
{
Version = data.ReadByte();
Augmentation = data.ReadString();
if (!string.IsNullOrEmpty(Augmentation))
{
AddressSize = 4;
SegmentSelectorSize = 0;
CodeAlignmentFactor = 0;
DataAlignmentFactor = 0;
ReturnAddressRegister = 0;
}
else
{
if (Version >= 4)
{
AddressSize = data.ReadByte();
SegmentSelectorSize = data.ReadByte();
}
else
{
AddressSize = defaultAddressSize;
SegmentSelectorSize = 0;
}
CodeAlignmentFactor = data.LEB128();
DataAlignmentFactor = data.LEB128();
ReturnAddressRegister = data.LEB128();
}
InitialInstructions = data.ReadBlock((uint)(endPosition - data.Position));
}
/// <summary>
/// Parses the data for this instance.
/// </summary>
/// <param name="data">The data memory reader.</param>
/// <param name="endPosition">The end position.</param>
/// <param name="input">The input data for parsing configuration.</param>
private void ParseData(DwarfMemoryReader data, int endPosition, DwarfExceptionHandlingFrameParsingInput input)
{
Version = data.ReadByte();
Augmentation = data.ReadString();
CodeAlignmentFactor = data.LEB128();
DataAlignmentFactor = data.SLEB128();
if (Version == 1)
{
ReturnAddressRegister = data.ReadByte();
}
else
{
ReturnAddressRegister = data.LEB128();
}
AddressSize = input.DefaultAddressSize;
SegmentSelectorSize = 0;
int instructionsStart = -1;
for (int i = 0; i < Augmentation.Length; i++)
{
if (Augmentation[i] == 'z')
{
uint length = data.LEB128();
instructionsStart = data.Position + (int)length;
}
else if (Augmentation[i] == 'L')
{
LanguageSpecificDataAreaEncoding = (DwarfExceptionHandlingEncoding)data.ReadByte();
}
else if (Augmentation[i] == 'R')
{
FrameDescriptionAddressEncoding = (DwarfExceptionHandlingEncoding)data.ReadByte();
}
else if (Augmentation[i] == 'S')
{
StackFrame = true;
}
else if (Augmentation[i] == 'P')
{
PersonalityEncoding = (DwarfExceptionHandlingEncoding)data.ReadByte();
PersonalityLocation = ReadEncodedAddress(data, PersonalityEncoding, input);
}
else
{
break;
}
}
if (instructionsStart >= 0)
{
data.Position = instructionsStart;
}
InitialInstructions = data.ReadBlock((uint)(endPosition - data.Position));
}
/// <summary>
/// Parses the specified data.
/// </summary>
/// <param name="data">The PE image data.</param>
private void ParseData(byte[] data)
{
using (DwarfMemoryReader reader = new DwarfMemoryReader(data))
{
dosHeader = reader.ReadStructure <IMAGE_DOS_HEADER>();
if (dosHeader.e_magic != IMAGE_DOS_SIGNATURE)
{
throw new ArgumentException($"Invalid IMAGE_DOS_HEADER magic constant. Expected: 0x{IMAGE_DOS_SIGNATURE:X}, Got: 0x{dosHeader.e_magic:X}");
}
reader.Position = (int)dosHeader.e_lfanew;
ntHeaders32 = reader.ReadStructure <IMAGE_NT_HEADERS32>();
if (ntHeaders32.Signature != IMAGE_NT_SIGNATURE)
{
throw new ArgumentException($"Invalid optional header signature. Expected: 0x{IMAGE_NT_SIGNATURE:X}, Got: 0x{ntHeaders32.Signature:X}");
}
if (ntHeaders32.FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 ||
ntHeaders32.FileHeader.Machine == IMAGE_FILE_MACHINE_IA64)
{
reader.Position = (int)dosHeader.e_lfanew;
ntHeaders64 = reader.ReadStructure <IMAGE_NT_HEADERS64>();
Is64bit = true;
fileHeader = ntHeaders64.FileHeader;
reader.Position += ntHeaders64.FileHeader.SizeOfOptionalHeader - Marshal.SizeOf <IMAGE_OPTIONAL_HEADER64>();
CodeSegmentOffset = ntHeaders64.OptionalHeader.ImageBase;
}
else
{
Is64bit = false;
fileHeader = ntHeaders32.FileHeader;
reader.Position += ntHeaders32.FileHeader.SizeOfOptionalHeader - Marshal.SizeOf <IMAGE_OPTIONAL_HEADER32>();
CodeSegmentOffset = ntHeaders32.OptionalHeader.ImageBase;
}
// Load image section headers
uint stringTablePosition = fileHeader.PointerToSymbolTable + fileHeader.NumberOfSymbols * IMAGE_SIZEOF_SYMBOL;
imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections];
for (int section = 0; section < imageSectionHeaders.Length; section++)
{
IMAGE_SECTION_HEADER imageSectionHeader = reader.ReadStructure <IMAGE_SECTION_HEADER>();
imageSectionHeaders[section] = imageSectionHeader;
string name = imageSectionHeader.Section;
if (imageSectionHeader.Name[0] == '/')
{
uint position = stringTablePosition + uint.Parse(imageSectionHeader.Section.Substring(1));
name = reader.ReadString((int)position);
}
switch (name)
{
case ".debug_info":
DebugData = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData);
break;
case ".debug_abbrev":
DebugDataDescription = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData);
break;
case ".debug_line":
DebugLine = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData);
break;
case ".debug_frame":
DebugFrame = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData);
break;
case ".debug_str":
DebugDataStrings = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData);
break;
case ".eh_frame":
EhFrame = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData);
EhFrameAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset;
break;
case ".data":
DataSectionAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset;
break;
case ".text":
TextSectionAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset;
break;
}
}
// Load image symbols
List <PublicSymbol> publicSymbols = new List <PublicSymbol>();
byte toSkip = 0;
reader.Position = (int)fileHeader.PointerToSymbolTable;
for (uint i = 0; i < fileHeader.NumberOfSymbols; i++)
{
int position = reader.Position;
IMAGE_SYMBOL symbol = reader.ReadStructure <IMAGE_SYMBOL>();
if (toSkip == 0)
{
string name = symbol.SymbolName;
if (string.IsNullOrEmpty(name))
{
int stringPosition = (int)reader.ReadUint(position);
stringPosition = (int)reader.ReadUint(position + 4);
name = reader.ReadString((int)stringTablePosition + stringPosition);
}
if (symbol.SectionNumber > 0 && symbol.SectionNumber <= imageSectionHeaders.Length)
{
uint sectionAddress = imageSectionHeaders[symbol.SectionNumber - 1].VirtualAddress;
sectionAddress += symbol.Value;
publicSymbols.Add(new PublicSymbol(name, sectionAddress));
}
toSkip = symbol.NumberOfAuxSymbols;
}
else
{
toSkip--;
}
}
PublicSymbols = publicSymbols;
}
}
/// <summary>
/// Initializes a new instance of the <see cref="ElfCoreDump"/> class.
/// </summary>
/// <param name="coreDumpPath">The core dump path.</param>
public ElfCoreDump(string coreDumpPath)
{
elf = ELFReader.Load <ulong>(coreDumpPath);
if (elf.Type != FileType.Core)
{
throw new Exception($"Expected core dump, but got: {elf.Type}");
}
switch (elf.Machine)
{
case Machine.Intel386:
instance = new Intel386Instance(elf);
break;
case Machine.AMD64:
instance = new AMD64Instance(elf);
break;
default:
throw new Exception($"Unsupported machine type: {elf.Machine}");
}
Path = coreDumpPath;
foreach (var segment in elf.Segments)
{
if (segment.Type == SegmentType.Note)
{
using (DwarfMemoryReader reader = new DwarfMemoryReader(ReadSegment(segment)))
{
int noteStructSize = Marshal.SizeOf <elf_32note>();
while (reader.Position + noteStructSize < reader.Data.Length)
{
// Read note
elf_32note note = reader.ReadStructure <elf_32note>();
int nameEnd = reader.Position + (int)note.NameSize;
// Check if note is available to be read
if (nameEnd + note.n_descsz > reader.Data.Length)
{
break;
}
// Read name and content
string name = reader.ReadString();
reader.Position = nameEnd;
byte[] content = reader.ReadBlock(note.n_descsz);
instance.ProcessNote(name, content, note.n_type);
if (note.n_type == elf_note_type.File)
{
using (DwarfMemoryReader data = new DwarfMemoryReader(content))
{
files = elf_note_file.Parse(data, Is64bit);
}
}
else if (note.n_type == elf_note_type.Auxv)
{
using (DwarfMemoryReader data = new DwarfMemoryReader(content))
{
uint addressSize = elf.Class == Class.Bit32 ? 4U : 8U;
while (!data.IsEnd)
{
AuxvEntry entry = new AuxvEntry
{
Type = (AuxvEntryType)data.ReadUlong(addressSize),
Value = data.ReadUlong(addressSize)
};
if (entry.Type == AuxvEntryType.Null)
{
break;
}
if (entry.Type == AuxvEntryType.Ignore)
{
continue;
}
auxVector.Add(entry);
}
}
}
}
}
}
}
DumpFileMemoryReader = new CoreDumpReader(coreDumpPath, elf.Segments.Where(s => s.Type == SegmentType.Load));
}
/// <summary>
/// Reads the data for this instance.
/// </summary>
/// <param name="debugData">The debug data.</param>
/// <param name="debugDataDescription">The debug data description.</param>
/// <param name="debugStrings">The debug strings.</param>
/// <param name="addressNormalizer">Normalize address delegate (<see cref="NormalizeAddressDelegate"/>)</param>
private void ReadData(DwarfMemoryReader debugData, DwarfMemoryReader debugDataDescription, DwarfMemoryReader debugStrings, NormalizeAddressDelegate addressNormalizer)
{
// Read header
bool is64bit;
int beginPosition = debugData.Position;
ulong length = debugData.ReadLength(out is64bit);
int endPosition = debugData.Position + (int)length;
ushort version = debugData.ReadUshort();
int debugDataDescriptionOffset = debugData.ReadOffset(is64bit);
byte addressSize = debugData.ReadByte();
DataDescriptionReader dataDescriptionReader = new DataDescriptionReader(debugDataDescription, debugDataDescriptionOffset);
// Read data
List <DwarfSymbol> symbols = new List <DwarfSymbol>();
Stack <DwarfSymbol> parents = new Stack <DwarfSymbol>();
while (debugData.Position < endPosition)
{
int dataPosition = debugData.Position;
uint code = debugData.LEB128();
if (code == 0)
{
parents.Pop();
continue;
}
DataDescription description = dataDescriptionReader.GetDebugDataDescription(code);
Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = new Dictionary <DwarfAttribute, DwarfAttributeValue>();
foreach (DataDescriptionAttribute descriptionAttribute in description.Attributes)
{
DwarfAttribute attribute = descriptionAttribute.Attribute;
DwarfFormat format = descriptionAttribute.Format;
DwarfAttributeValue attributeValue = new DwarfAttributeValue();
switch (format)
{
case DwarfFormat.Address:
attributeValue.Type = DwarfAttributeValueType.Address;
attributeValue.Value = debugData.ReadUlong(addressSize);
break;
case DwarfFormat.Block:
attributeValue.Type = DwarfAttributeValueType.Block;
attributeValue.Value = debugData.ReadBlock(debugData.LEB128());
break;
case DwarfFormat.Block1:
attributeValue.Type = DwarfAttributeValueType.Block;
attributeValue.Value = debugData.ReadBlock(debugData.ReadByte());
break;
case DwarfFormat.Block2:
attributeValue.Type = DwarfAttributeValueType.Block;
attributeValue.Value = debugData.ReadBlock(debugData.ReadUshort());
break;
case DwarfFormat.Block4:
attributeValue.Type = DwarfAttributeValueType.Block;
attributeValue.Value = debugData.ReadBlock(debugData.ReadUint());
break;
case DwarfFormat.Data1:
attributeValue.Type = DwarfAttributeValueType.Constant;
attributeValue.Value = (ulong)debugData.ReadByte();
break;
case DwarfFormat.Data2:
attributeValue.Type = DwarfAttributeValueType.Constant;
attributeValue.Value = (ulong)debugData.ReadUshort();
break;
case DwarfFormat.Data4:
attributeValue.Type = DwarfAttributeValueType.Constant;
attributeValue.Value = (ulong)debugData.ReadUint();
break;
case DwarfFormat.Data8:
attributeValue.Type = DwarfAttributeValueType.Constant;
attributeValue.Value = (ulong)debugData.ReadUlong();
break;
case DwarfFormat.SData:
attributeValue.Type = DwarfAttributeValueType.Constant;
attributeValue.Value = (ulong)debugData.SLEB128();
break;
case DwarfFormat.UData:
attributeValue.Type = DwarfAttributeValueType.Constant;
attributeValue.Value = (ulong)debugData.LEB128();
break;
case DwarfFormat.String:
attributeValue.Type = DwarfAttributeValueType.String;
attributeValue.Value = debugData.ReadString();
break;
case DwarfFormat.Strp:
attributeValue.Type = DwarfAttributeValueType.String;
attributeValue.Value = debugStrings.ReadString(debugData.ReadOffset(is64bit));
break;
case DwarfFormat.Flag:
attributeValue.Type = DwarfAttributeValueType.Flag;
attributeValue.Value = debugData.ReadByte() != 0;
break;
case DwarfFormat.FlagPresent:
attributeValue.Type = DwarfAttributeValueType.Flag;
attributeValue.Value = true;
break;
case DwarfFormat.Ref1:
attributeValue.Type = DwarfAttributeValueType.Reference;
attributeValue.Value = (ulong)debugData.ReadByte() + (ulong)beginPosition;
break;
case DwarfFormat.Ref2:
attributeValue.Type = DwarfAttributeValueType.Reference;
attributeValue.Value = (ulong)debugData.ReadUshort() + (ulong)beginPosition;
break;
case DwarfFormat.Ref4:
attributeValue.Type = DwarfAttributeValueType.Reference;
attributeValue.Value = (ulong)debugData.ReadUint() + (ulong)beginPosition;
break;
case DwarfFormat.Ref8:
attributeValue.Type = DwarfAttributeValueType.Reference;
attributeValue.Value = (ulong)debugData.ReadUlong() + (ulong)beginPosition;
break;
case DwarfFormat.RefUData:
attributeValue.Type = DwarfAttributeValueType.Reference;
attributeValue.Value = (ulong)debugData.LEB128() + (ulong)beginPosition;
break;
case DwarfFormat.RefAddr:
attributeValue.Type = DwarfAttributeValueType.Reference;
attributeValue.Value = (ulong)debugData.ReadOffset(is64bit);
break;
case DwarfFormat.RefSig8:
attributeValue.Type = DwarfAttributeValueType.Invalid;
debugData.Position += 8;
break;
case DwarfFormat.ExpressionLocation:
attributeValue.Type = DwarfAttributeValueType.ExpressionLocation;
attributeValue.Value = debugData.ReadBlock(debugData.LEB128());
break;
case DwarfFormat.SecOffset:
attributeValue.Type = DwarfAttributeValueType.SecOffset;
attributeValue.Value = (ulong)debugData.ReadOffset(is64bit);
break;
default:
throw new Exception($"Unsupported DwarfFormat: {format}");
}
if (attributes.ContainsKey(attribute))
{
if (attributes[attribute] != attributeValue)
{
attributes[attribute] = attributeValue;
}
}
else
{
attributes.Add(attribute, attributeValue);
}
}
DwarfSymbol symbol = new DwarfSymbol()
{
Tag = description.Tag,
Attributes = attributes,
Offset = dataPosition,
};
symbolsByOffset.Add(symbol.Offset, symbol);
if (parents.Count > 0)
{
parents.Peek().Children.Add(symbol);
symbol.Parent = parents.Peek();
}
else
{
symbols.Add(symbol);
}
if (description.HasChildren)
{
symbol.Children = new List <DwarfSymbol>();
parents.Push(symbol);
}
}
SymbolsTree = symbols.ToArray();
if (SymbolsTree.Length > 0)
{
// Add void type symbol
DwarfSymbol voidSymbol = new DwarfSymbol()
{
Tag = DwarfTag.BaseType,
Offset = -1,
Parent = SymbolsTree[0],
Attributes = new Dictionary <DwarfAttribute, DwarfAttributeValue>()
{
{ DwarfAttribute.Name, new DwarfAttributeValue()
{
Type = DwarfAttributeValueType.String, Value = "void"
} },
{ DwarfAttribute.ByteSize, new DwarfAttributeValue()
{
Type = DwarfAttributeValueType.Constant, Value = (ulong)0
} },
},
};
if (SymbolsTree[0].Children == null)
{
SymbolsTree[0].Children = new List <DwarfSymbol>();
}
SymbolsTree[0].Children.Insert(0, voidSymbol);
symbolsByOffset.Add(voidSymbol.Offset, voidSymbol);
// Post process all symbols
foreach (DwarfSymbol symbol in Symbols)
{
Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = symbol.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>;
foreach (DwarfAttributeValue value in attributes.Values)
{
if (value.Type == DwarfAttributeValueType.Reference)
{
DwarfSymbol reference;
if (symbolsByOffset.TryGetValue((int)value.Address, out reference))
{
value.Type = DwarfAttributeValueType.ResolvedReference;
value.Value = reference;
}
}
else if (value.Type == DwarfAttributeValueType.Address)
{
value.Value = addressNormalizer(value.Address);
}
}
if ((symbol.Tag == DwarfTag.PointerType && !attributes.ContainsKey(DwarfAttribute.Type)) ||
(symbol.Tag == DwarfTag.Typedef && !attributes.ContainsKey(DwarfAttribute.Type)))
{
attributes.Add(DwarfAttribute.Type, new DwarfAttributeValue()
{
Type = DwarfAttributeValueType.ResolvedReference,
Value = voidSymbol,
});
}
}
// Merge specifications
foreach (DwarfSymbol symbol in Symbols)
{
Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = symbol.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>;
DwarfAttributeValue specificationValue;
if (attributes.TryGetValue(DwarfAttribute.Specification, out specificationValue) && specificationValue.Type == DwarfAttributeValueType.ResolvedReference)
{
DwarfSymbol reference = specificationValue.Reference;
Dictionary <DwarfAttribute, DwarfAttributeValue> referenceAttributes = reference.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>;
foreach (KeyValuePair <DwarfAttribute, DwarfAttributeValue> kvp in attributes)
{
if (kvp.Key != DwarfAttribute.Specification)
{
referenceAttributes[kvp.Key] = kvp.Value;
}
}
}
}
}
}