public static elf_note_file[] Parse(DwarfMemoryReader reader, bool is64bit) { ulong count = is64bit ? reader.ReadUlong() : reader.ReadUint(); ulong page_size = is64bit ? reader.ReadUlong() : reader.ReadUint(); elf_note_file[] files = new elf_note_file[count]; for (int i = 0; i < files.Length; i++) { files[i].start = is64bit ? reader.ReadUlong() : reader.ReadUint(); files[i].end = is64bit ? reader.ReadUlong() : reader.ReadUint(); files[i].file_ofs = (is64bit ? reader.ReadUlong() : reader.ReadUint()) * page_size; } for (int i = 0; i < files.Length; i++) { files[i].name = reader.ReadString(); } return(files); }
/// <summary> /// Reads the data for single instance. /// </summary> /// <param name="debugLine">The debug line data stream.</param> /// <param name="addressNormalizer">Normalize address delegate (<see cref="NormalizeAddressDelegate"/>)</param> /// <returns>List of file information.</returns> private static List <DwarfFileInformation> ReadData(DwarfMemoryReader debugLine, NormalizeAddressDelegate addressNormalizer) { // Read header bool is64bit; int beginPosition = debugLine.Position; ulong length = debugLine.ReadLength(out is64bit); int endPosition = debugLine.Position + (int)length; ushort version = debugLine.ReadUshort(); int headerLength = debugLine.ReadOffset(is64bit); byte minimumInstructionLength = debugLine.ReadByte(); bool defaultIsStatement = debugLine.ReadByte() != 0; sbyte lineBase = (sbyte)debugLine.ReadByte(); byte lineRange = debugLine.ReadByte(); byte operationCodeBase = debugLine.ReadByte(); // Read operation code lengths uint[] operationCodeLengths = new uint[operationCodeBase]; operationCodeLengths[0] = 0; for (int i = 1; i < operationCodeLengths.Length && debugLine.Position < endPosition; i++) { operationCodeLengths[i] = debugLine.LEB128(); } // Read directories List <string> directories = new List <string>(); while (debugLine.Position < endPosition && debugLine.Peek() != 0) { string directory = debugLine.ReadString(); directory = directory.Replace('/', Path.DirectorySeparatorChar); directories.Add(directory); } debugLine.ReadByte(); // Skip zero termination byte // Read files List <DwarfFileInformation> files = new List <DwarfFileInformation>(); while (debugLine.Position < endPosition && debugLine.Peek() != 0) { files.Add(ReadFile(debugLine, directories)); } debugLine.ReadByte(); // Skip zero termination byte // Parse lines ParsingState state = new ParsingState(files.FirstOrDefault(), defaultIsStatement, minimumInstructionLength); uint lastAddress = 0; while (debugLine.Position < endPosition) { byte operationCode = debugLine.ReadByte(); if (operationCode >= operationCodeLengths.Length) { // Special operation code int adjustedOperationCode = operationCode - operationCodeBase; int operationAdvance = adjustedOperationCode / lineRange; state.AdvanceAddress(operationAdvance); int lineAdvance = lineBase + (adjustedOperationCode % lineRange); state.Line += (uint)lineAdvance; state.AddCurrentLineInfo(); state.IsBasicBlock = false; state.IsPrologueEnd = false; state.IsEpilogueEnd = false; state.Discriminator = 0; } else { switch ((DwarfLineNumberStandardOpcode)operationCode) { case DwarfLineNumberStandardOpcode.Extended: { uint extendedLength = debugLine.LEB128(); int newPosition = debugLine.Position + (int)extendedLength; DwarfLineNumberExtendedOpcode extendedCode = (DwarfLineNumberExtendedOpcode)debugLine.ReadByte(); switch (extendedCode) { case DwarfLineNumberExtendedOpcode.EndSequence: lastAddress = state.Address; state.IsSequenceEnd = true; state.AddCurrentLineInfo(); state.Reset(files.FirstOrDefault()); break; case DwarfLineNumberExtendedOpcode.SetAddress: { state.Address = debugLine.ReadUint(); if (state.Address == 0) { state.Address = lastAddress; } state.OperationIndex = 0; } break; case DwarfLineNumberExtendedOpcode.DefineFile: state.File = ReadFile(debugLine, directories); files.Add(state.File); break; case DwarfLineNumberExtendedOpcode.SetDiscriminator: state.Discriminator = debugLine.LEB128(); break; default: throw new Exception($"Unsupported DwarfLineNumberExtendedOpcode: {extendedCode}"); } debugLine.Position = newPosition; } break; case DwarfLineNumberStandardOpcode.Copy: state.AddCurrentLineInfo(); state.IsBasicBlock = false; state.IsPrologueEnd = false; state.IsEpilogueEnd = false; state.Discriminator = 0; break; case DwarfLineNumberStandardOpcode.AdvancePc: state.AdvanceAddress((int)debugLine.LEB128()); break; case DwarfLineNumberStandardOpcode.AdvanceLine: state.Line += debugLine.SLEB128(); break; case DwarfLineNumberStandardOpcode.SetFile: state.File = files[(int)debugLine.LEB128() - 1]; break; case DwarfLineNumberStandardOpcode.SetColumn: state.Column = debugLine.LEB128(); break; case DwarfLineNumberStandardOpcode.NegateStmt: state.IsStatement = !state.IsStatement; break; case DwarfLineNumberStandardOpcode.SetBasicBlock: state.IsBasicBlock = true; break; case DwarfLineNumberStandardOpcode.ConstAddPc: state.AdvanceAddress((255 - operationCodeBase) / lineRange); break; case DwarfLineNumberStandardOpcode.FixedAdvancePc: state.Address += debugLine.ReadUshort(); state.OperationIndex = 0; break; case DwarfLineNumberStandardOpcode.SetPrologueEnd: state.IsPrologueEnd = true; break; case DwarfLineNumberStandardOpcode.SetEpilogueBegin: state.IsEpilogueEnd = true; break; case DwarfLineNumberStandardOpcode.SetIsa: state.Isa = debugLine.LEB128(); break; default: throw new Exception($"Unsupported DwarfLineNumberStandardOpcode: {(DwarfLineNumberStandardOpcode)operationCode}"); } } } // Fix lines in files... foreach (DwarfFileInformation file in files) { for (int i = 0; i < file.Lines.Count; i++) { file.Lines[i].Address = (uint)addressNormalizer(file.Lines[i].Address); } } return(files); }
/// <summary> /// Parses the specified data. /// </summary> /// <param name="data">The PE image data.</param> private void ParseData(byte[] data) { using (DwarfMemoryReader reader = new DwarfMemoryReader(data)) { dosHeader = reader.ReadStructure <IMAGE_DOS_HEADER>(); if (dosHeader.e_magic != IMAGE_DOS_SIGNATURE) { throw new ArgumentException($"Invalid IMAGE_DOS_HEADER magic constant. Expected: 0x{IMAGE_DOS_SIGNATURE:X}, Got: 0x{dosHeader.e_magic:X}"); } reader.Position = (int)dosHeader.e_lfanew; ntHeaders32 = reader.ReadStructure <IMAGE_NT_HEADERS32>(); if (ntHeaders32.Signature != IMAGE_NT_SIGNATURE) { throw new ArgumentException($"Invalid optional header signature. Expected: 0x{IMAGE_NT_SIGNATURE:X}, Got: 0x{ntHeaders32.Signature:X}"); } if (ntHeaders32.FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 || ntHeaders32.FileHeader.Machine == IMAGE_FILE_MACHINE_IA64) { reader.Position = (int)dosHeader.e_lfanew; ntHeaders64 = reader.ReadStructure <IMAGE_NT_HEADERS64>(); Is64bit = true; fileHeader = ntHeaders64.FileHeader; reader.Position += ntHeaders64.FileHeader.SizeOfOptionalHeader - Marshal.SizeOf <IMAGE_OPTIONAL_HEADER64>(); CodeSegmentOffset = ntHeaders64.OptionalHeader.ImageBase; } else { Is64bit = false; fileHeader = ntHeaders32.FileHeader; reader.Position += ntHeaders32.FileHeader.SizeOfOptionalHeader - Marshal.SizeOf <IMAGE_OPTIONAL_HEADER32>(); CodeSegmentOffset = ntHeaders32.OptionalHeader.ImageBase; } // Load image section headers uint stringTablePosition = fileHeader.PointerToSymbolTable + fileHeader.NumberOfSymbols * IMAGE_SIZEOF_SYMBOL; imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections]; for (int section = 0; section < imageSectionHeaders.Length; section++) { IMAGE_SECTION_HEADER imageSectionHeader = reader.ReadStructure <IMAGE_SECTION_HEADER>(); imageSectionHeaders[section] = imageSectionHeader; string name = imageSectionHeader.Section; if (imageSectionHeader.Name[0] == '/') { uint position = stringTablePosition + uint.Parse(imageSectionHeader.Section.Substring(1)); name = reader.ReadString((int)position); } switch (name) { case ".debug_info": DebugData = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".debug_abbrev": DebugDataDescription = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".debug_line": DebugLine = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".debug_frame": DebugFrame = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".debug_str": DebugDataStrings = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".eh_frame": EhFrame = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); EhFrameAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset; break; case ".data": DataSectionAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset; break; case ".text": TextSectionAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset; break; } } // Load image symbols List <PublicSymbol> publicSymbols = new List <PublicSymbol>(); byte toSkip = 0; reader.Position = (int)fileHeader.PointerToSymbolTable; for (uint i = 0; i < fileHeader.NumberOfSymbols; i++) { int position = reader.Position; IMAGE_SYMBOL symbol = reader.ReadStructure <IMAGE_SYMBOL>(); if (toSkip == 0) { string name = symbol.SymbolName; if (string.IsNullOrEmpty(name)) { int stringPosition = (int)reader.ReadUint(position); stringPosition = (int)reader.ReadUint(position + 4); name = reader.ReadString((int)stringTablePosition + stringPosition); } if (symbol.SectionNumber > 0 && symbol.SectionNumber <= imageSectionHeaders.Length) { uint sectionAddress = imageSectionHeaders[symbol.SectionNumber - 1].VirtualAddress; sectionAddress += symbol.Value; publicSymbols.Add(new PublicSymbol(name, sectionAddress)); } toSkip = symbol.NumberOfAuxSymbols; } else { toSkip--; } } PublicSymbols = publicSymbols; } }
/// <summary> /// Reads the data for this instance. /// </summary> /// <param name="debugData">The debug data.</param> /// <param name="debugDataDescription">The debug data description.</param> /// <param name="debugStrings">The debug strings.</param> /// <param name="codeSegmentOffset">The code segment offset.</param> private void ReadData(DwarfMemoryReader debugData, DwarfMemoryReader debugDataDescription, DwarfMemoryReader debugStrings, ulong codeSegmentOffset) { // Read header bool is64bit; int beginPosition = debugData.Position; ulong length = debugData.ReadLength(out is64bit); int endPosition = debugData.Position + (int)length; ushort version = debugData.ReadUshort(); int debugDataDescriptionOffset = debugData.ReadOffset(is64bit); byte addressSize = debugData.ReadByte(); DataDescriptionReader dataDescriptionReader = new DataDescriptionReader(debugDataDescription, debugDataDescriptionOffset); // Read data List <DwarfSymbol> symbols = new List <DwarfSymbol>(); Stack <DwarfSymbol> parents = new Stack <DwarfSymbol>(); while (debugData.Position < endPosition) { int dataPosition = debugData.Position; uint code = debugData.LEB128(); if (code == 0) { parents.Pop(); continue; } DataDescription description = dataDescriptionReader.GetDebugDataDescription(code); Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = new Dictionary <DwarfAttribute, DwarfAttributeValue>(); foreach (DataDescriptionAttribute descriptionAttribute in description.Attributes) { DwarfAttribute attribute = descriptionAttribute.Attribute; DwarfFormat format = descriptionAttribute.Format; DwarfAttributeValue attributeValue = new DwarfAttributeValue(); switch (format) { case DwarfFormat.Address: attributeValue.Type = DwarfAttributeValueType.Address; attributeValue.Value = debugData.ReadUlong(addressSize); break; case DwarfFormat.Block: attributeValue.Type = DwarfAttributeValueType.Block; attributeValue.Value = debugData.ReadBlock(debugData.LEB128()); break; case DwarfFormat.Block1: attributeValue.Type = DwarfAttributeValueType.Block; attributeValue.Value = debugData.ReadBlock(debugData.ReadByte()); break; case DwarfFormat.Block2: attributeValue.Type = DwarfAttributeValueType.Block; attributeValue.Value = debugData.ReadBlock(debugData.ReadUshort()); break; case DwarfFormat.Block4: attributeValue.Type = DwarfAttributeValueType.Block; attributeValue.Value = debugData.ReadBlock(debugData.ReadUint()); break; case DwarfFormat.Data1: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.ReadByte(); break; case DwarfFormat.Data2: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.ReadUshort(); break; case DwarfFormat.Data4: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.ReadUint(); break; case DwarfFormat.Data8: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.ReadUlong(); break; case DwarfFormat.SData: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.SLEB128(); break; case DwarfFormat.UData: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.LEB128(); break; case DwarfFormat.String: attributeValue.Type = DwarfAttributeValueType.String; attributeValue.Value = debugData.ReadString(); break; case DwarfFormat.Strp: attributeValue.Type = DwarfAttributeValueType.String; attributeValue.Value = debugStrings.ReadString(debugData.ReadOffset(is64bit)); break; case DwarfFormat.Flag: attributeValue.Type = DwarfAttributeValueType.Flag; attributeValue.Value = debugData.ReadByte() != 0; break; case DwarfFormat.FlagPresent: attributeValue.Type = DwarfAttributeValueType.Flag; attributeValue.Value = true; break; case DwarfFormat.Ref1: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadByte() + (ulong)beginPosition; break; case DwarfFormat.Ref2: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadUshort() + (ulong)beginPosition; break; case DwarfFormat.Ref4: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadUint() + (ulong)beginPosition; break; case DwarfFormat.Ref8: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadUlong() + (ulong)beginPosition; break; case DwarfFormat.RefUData: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.LEB128() + (ulong)beginPosition; break; case DwarfFormat.RefAddr: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadOffset(is64bit); break; case DwarfFormat.RefSig8: attributeValue.Type = DwarfAttributeValueType.Invalid; debugData.Position += 8; break; case DwarfFormat.ExpressionLocation: attributeValue.Type = DwarfAttributeValueType.ExpressionLocation; attributeValue.Value = debugData.ReadBlock(debugData.LEB128()); break; case DwarfFormat.SecOffset: attributeValue.Type = DwarfAttributeValueType.SecOffset; attributeValue.Value = (ulong)debugData.ReadOffset(is64bit); break; default: throw new Exception($"Unsupported DwarfFormat: {format}"); } if (attributes.ContainsKey(attribute)) { if (attributes[attribute] != attributeValue) { attributes[attribute] = attributeValue; } } else { attributes.Add(attribute, attributeValue); } } DwarfSymbol symbol = new DwarfSymbol() { Tag = description.Tag, Attributes = attributes, Offset = dataPosition, }; symbolsByOffset.Add(symbol.Offset, symbol); if (parents.Count > 0) { parents.Peek().Children.Add(symbol); symbol.Parent = parents.Peek(); } else { symbols.Add(symbol); } if (description.HasChildren) { symbol.Children = new List <DwarfSymbol>(); parents.Push(symbol); } } SymbolsTree = symbols.ToArray(); if (SymbolsTree.Length > 0) { // Add void type symbol DwarfSymbol voidSymbol = new DwarfSymbol() { Tag = DwarfTag.BaseType, Offset = -1, Parent = SymbolsTree[0], Attributes = new Dictionary <DwarfAttribute, DwarfAttributeValue>() { { DwarfAttribute.Name, new DwarfAttributeValue() { Type = DwarfAttributeValueType.String, Value = "void" } }, { DwarfAttribute.ByteSize, new DwarfAttributeValue() { Type = DwarfAttributeValueType.Constant, Value = (ulong)0 } }, }, }; if (SymbolsTree[0].Children == null) { SymbolsTree[0].Children = new List <DwarfSymbol>(); } SymbolsTree[0].Children.Insert(0, voidSymbol); symbolsByOffset.Add(voidSymbol.Offset, voidSymbol); // Post process all symbols foreach (DwarfSymbol symbol in Symbols) { Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = symbol.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>; foreach (DwarfAttributeValue value in attributes.Values) { if (value.Type == DwarfAttributeValueType.Reference) { DwarfSymbol reference; if (symbolsByOffset.TryGetValue((int)value.Address, out reference)) { value.Type = DwarfAttributeValueType.ResolvedReference; value.Value = reference; } } else if (value.Type == DwarfAttributeValueType.Address) { value.Value = value.Address - codeSegmentOffset; } } if ((symbol.Tag == DwarfTag.PointerType && !attributes.ContainsKey(DwarfAttribute.Type)) || (symbol.Tag == DwarfTag.Typedef && !attributes.ContainsKey(DwarfAttribute.Type))) { attributes.Add(DwarfAttribute.Type, new DwarfAttributeValue() { Type = DwarfAttributeValueType.ResolvedReference, Value = voidSymbol, }); } } // Merge specifications foreach (DwarfSymbol symbol in Symbols) { Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = symbol.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>; DwarfAttributeValue specificationValue; if (attributes.TryGetValue(DwarfAttribute.Specification, out specificationValue) && specificationValue.Type == DwarfAttributeValueType.ResolvedReference) { DwarfSymbol reference = specificationValue.Reference; Dictionary <DwarfAttribute, DwarfAttributeValue> referenceAttributes = reference.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>; foreach (KeyValuePair <DwarfAttribute, DwarfAttributeValue> kvp in attributes) { if (kvp.Key != DwarfAttribute.Specification) { referenceAttributes[kvp.Key] = kvp.Value; } } } } } }
/// <summary> /// Reads encoded address from the specified data memory reader. /// </summary> /// <param name="data">The data memory reader.</param> /// <param name="encoding">Encoding used for storing address value.</param> /// <param name="input">The input data for parsing configuration.</param> /// <returns>Decoded address value.</returns> private static ulong ReadEncodedAddress(DwarfMemoryReader data, DwarfExceptionHandlingEncoding encoding, DwarfExceptionHandlingFrameParsingInput input) { bool signExtendValue = false; ulong baseAddress = 0; switch (encoding & DwarfExceptionHandlingEncoding.Modifiers) { case DwarfExceptionHandlingEncoding.PcRelative: signExtendValue = true; baseAddress = (ulong)data.Position; if (input.PcRelativeAddress != ulong.MaxValue) { baseAddress += input.PcRelativeAddress; } break; case DwarfExceptionHandlingEncoding.TextRelative: signExtendValue = true; if (input.TextAddress != ulong.MaxValue) { baseAddress = input.TextAddress; } break; case DwarfExceptionHandlingEncoding.DataRelative: signExtendValue = true; if (input.DataAddress != ulong.MaxValue) { baseAddress = input.DataAddress; } break; case DwarfExceptionHandlingEncoding.FunctionRelative: signExtendValue = true; break; case DwarfExceptionHandlingEncoding.Aligned: { int alignment = data.Position % input.DefaultAddressSize; if (alignment > 0) { data.Position += input.DefaultAddressSize - alignment; } } break; } ulong address = 0; switch (encoding & DwarfExceptionHandlingEncoding.Mask) { case DwarfExceptionHandlingEncoding.Signed: case DwarfExceptionHandlingEncoding.AbsolutePointer: address = data.ReadUlong(input.DefaultAddressSize); break; case DwarfExceptionHandlingEncoding.UnsignedData2: address = data.ReadUshort(); break; case DwarfExceptionHandlingEncoding.UnsignedData4: address = data.ReadUint(); break; case DwarfExceptionHandlingEncoding.SignedData8: case DwarfExceptionHandlingEncoding.UnsignedData8: address = data.ReadUlong(); break; case DwarfExceptionHandlingEncoding.Uleb128: address = data.LEB128(); break; case DwarfExceptionHandlingEncoding.Sleb128: address = data.SLEB128(); break; case DwarfExceptionHandlingEncoding.SignedData2: address = (ulong)(long)(short)data.ReadUshort(); break; case DwarfExceptionHandlingEncoding.SignedData4: address = (ulong)(long)(int)data.ReadUint(); break; } if (signExtendValue && input.DefaultAddressSize < System.Runtime.InteropServices.Marshal.SizeOf(address.GetType())) { ulong sign_bit = 1UL << ((input.DefaultAddressSize * 8) - 1); if ((sign_bit & address) != 0) { ulong mask = ~sign_bit + 1; address |= mask; } } return(baseAddress + address); }