/// <summary> /// Parses frame description from the specified data memory reader. /// </summary> /// <param name="data">The data memory reader.</param> /// <param name="entry">Common information entry for parsed frame description.</param> /// <param name="endPosition">Position in the data reader where parsed frame description ends.</param> /// <param name="input">The input data for parsing configuration.</param> /// <returns>Parsed frame description.</returns> private static DwarfFrameDescriptionEntry ParseDescription(DwarfMemoryReader data, DwarfExceptionHandlingCommonInformationEntry entry, int endPosition, DwarfExceptionHandlingFrameParsingInput input) { DwarfFrameDescriptionEntry description = new DwarfFrameDescriptionEntry(); description.InitialLocation = ReadEncodedAddress(data, entry.FrameDescriptionAddressEncoding, input); description.AddressRange = ReadEncodedAddress(data, entry.FrameDescriptionAddressEncoding & DwarfExceptionHandlingEncoding.Mask, input); description.CommonInformationEntry = entry; int instructionsStart = -1; if (entry.Augmentation.Length >= 1 && entry.Augmentation[0] == 'z') { uint length = data.LEB128(); instructionsStart = data.Position + (int)length; if (entry.LanguageSpecificDataAreaEncoding != DwarfExceptionHandlingEncoding.Omit) { ulong lsdaDataFileAddress = ReadEncodedAddress(data, entry.LanguageSpecificDataAreaEncoding, input); } } if (instructionsStart >= 0) { data.Position = instructionsStart; } description.Instructions = data.ReadBlock((uint)(endPosition - data.Position)); return(description); }
/// <summary> /// Parses the data for this instance. /// </summary> /// <param name="data">The data memory reader.</param> /// <param name="defaultAddressSize">Default size of the address.</param> /// <param name="endPosition">The end position.</param> private void ParseData(DwarfMemoryReader data, byte defaultAddressSize, int endPosition) { Version = data.ReadByte(); Augmentation = data.ReadString(); if (!string.IsNullOrEmpty(Augmentation)) { AddressSize = 4; SegmentSelectorSize = 0; CodeAlignmentFactor = 0; DataAlignmentFactor = 0; ReturnAddressRegister = 0; } else { if (Version >= 4) { AddressSize = data.ReadByte(); SegmentSelectorSize = data.ReadByte(); } else { AddressSize = defaultAddressSize; SegmentSelectorSize = 0; } CodeAlignmentFactor = data.LEB128(); DataAlignmentFactor = data.LEB128(); ReturnAddressRegister = data.LEB128(); } InitialInstructions = data.ReadBlock((uint)(endPosition - data.Position)); }
/// <summary> /// Parses the data for this instance. /// </summary> /// <param name="data">The data memory reader.</param> /// <param name="endPosition">The end position.</param> /// <param name="input">The input data for parsing configuration.</param> private void ParseData(DwarfMemoryReader data, int endPosition, DwarfExceptionHandlingFrameParsingInput input) { Version = data.ReadByte(); Augmentation = data.ReadString(); CodeAlignmentFactor = data.LEB128(); DataAlignmentFactor = data.SLEB128(); if (Version == 1) { ReturnAddressRegister = data.ReadByte(); } else { ReturnAddressRegister = data.LEB128(); } AddressSize = input.DefaultAddressSize; SegmentSelectorSize = 0; int instructionsStart = -1; for (int i = 0; i < Augmentation.Length; i++) { if (Augmentation[i] == 'z') { uint length = data.LEB128(); instructionsStart = data.Position + (int)length; } else if (Augmentation[i] == 'L') { LanguageSpecificDataAreaEncoding = (DwarfExceptionHandlingEncoding)data.ReadByte(); } else if (Augmentation[i] == 'R') { FrameDescriptionAddressEncoding = (DwarfExceptionHandlingEncoding)data.ReadByte(); } else if (Augmentation[i] == 'S') { StackFrame = true; } else if (Augmentation[i] == 'P') { PersonalityEncoding = (DwarfExceptionHandlingEncoding)data.ReadByte(); PersonalityLocation = ReadEncodedAddress(data, PersonalityEncoding, input); } else { break; } } if (instructionsStart >= 0) { data.Position = instructionsStart; } InitialInstructions = data.ReadBlock((uint)(endPosition - data.Position)); }
/// <summary> /// Parses the specified data. /// </summary> /// <param name="data">The PE image data.</param> private void ParseData(byte[] data) { using (DwarfMemoryReader reader = new DwarfMemoryReader(data)) { dosHeader = reader.ReadStructure <IMAGE_DOS_HEADER>(); if (dosHeader.e_magic != IMAGE_DOS_SIGNATURE) { throw new ArgumentException($"Invalid IMAGE_DOS_HEADER magic constant. Expected: 0x{IMAGE_DOS_SIGNATURE:X}, Got: 0x{dosHeader.e_magic:X}"); } reader.Position = (int)dosHeader.e_lfanew; ntHeaders32 = reader.ReadStructure <IMAGE_NT_HEADERS32>(); if (ntHeaders32.Signature != IMAGE_NT_SIGNATURE) { throw new ArgumentException($"Invalid optional header signature. Expected: 0x{IMAGE_NT_SIGNATURE:X}, Got: 0x{ntHeaders32.Signature:X}"); } if (ntHeaders32.FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 || ntHeaders32.FileHeader.Machine == IMAGE_FILE_MACHINE_IA64) { reader.Position = (int)dosHeader.e_lfanew; ntHeaders64 = reader.ReadStructure <IMAGE_NT_HEADERS64>(); Is64bit = true; fileHeader = ntHeaders64.FileHeader; reader.Position += ntHeaders64.FileHeader.SizeOfOptionalHeader - Marshal.SizeOf <IMAGE_OPTIONAL_HEADER64>(); CodeSegmentOffset = ntHeaders64.OptionalHeader.ImageBase; } else { Is64bit = false; fileHeader = ntHeaders32.FileHeader; reader.Position += ntHeaders32.FileHeader.SizeOfOptionalHeader - Marshal.SizeOf <IMAGE_OPTIONAL_HEADER32>(); CodeSegmentOffset = ntHeaders32.OptionalHeader.ImageBase; } // Load image section headers uint stringTablePosition = fileHeader.PointerToSymbolTable + fileHeader.NumberOfSymbols * IMAGE_SIZEOF_SYMBOL; imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections]; for (int section = 0; section < imageSectionHeaders.Length; section++) { IMAGE_SECTION_HEADER imageSectionHeader = reader.ReadStructure <IMAGE_SECTION_HEADER>(); imageSectionHeaders[section] = imageSectionHeader; string name = imageSectionHeader.Section; if (imageSectionHeader.Name[0] == '/') { uint position = stringTablePosition + uint.Parse(imageSectionHeader.Section.Substring(1)); name = reader.ReadString((int)position); } switch (name) { case ".debug_info": DebugData = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".debug_abbrev": DebugDataDescription = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".debug_line": DebugLine = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".debug_frame": DebugFrame = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".debug_str": DebugDataStrings = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); break; case ".eh_frame": EhFrame = reader.ReadBlock(imageSectionHeader.SizeInImage, (int)imageSectionHeader.PointerToRawData); EhFrameAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset; break; case ".data": DataSectionAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset; break; case ".text": TextSectionAddress = imageSectionHeader.PointerToRawData + CodeSegmentOffset; break; } } // Load image symbols List <PublicSymbol> publicSymbols = new List <PublicSymbol>(); byte toSkip = 0; reader.Position = (int)fileHeader.PointerToSymbolTable; for (uint i = 0; i < fileHeader.NumberOfSymbols; i++) { int position = reader.Position; IMAGE_SYMBOL symbol = reader.ReadStructure <IMAGE_SYMBOL>(); if (toSkip == 0) { string name = symbol.SymbolName; if (string.IsNullOrEmpty(name)) { int stringPosition = (int)reader.ReadUint(position); stringPosition = (int)reader.ReadUint(position + 4); name = reader.ReadString((int)stringTablePosition + stringPosition); } if (symbol.SectionNumber > 0 && symbol.SectionNumber <= imageSectionHeaders.Length) { uint sectionAddress = imageSectionHeaders[symbol.SectionNumber - 1].VirtualAddress; sectionAddress += symbol.Value; publicSymbols.Add(new PublicSymbol(name, sectionAddress)); } toSkip = symbol.NumberOfAuxSymbols; } else { toSkip--; } } PublicSymbols = publicSymbols; } }
/// <summary> /// Initializes a new instance of the <see cref="ElfCoreDump"/> class. /// </summary> /// <param name="coreDumpPath">The core dump path.</param> public ElfCoreDump(string coreDumpPath) { elf = ELFReader.Load <ulong>(coreDumpPath); if (elf.Type != FileType.Core) { throw new Exception($"Expected core dump, but got: {elf.Type}"); } switch (elf.Machine) { case Machine.Intel386: instance = new Intel386Instance(elf); break; case Machine.AMD64: instance = new AMD64Instance(elf); break; default: throw new Exception($"Unsupported machine type: {elf.Machine}"); } Path = coreDumpPath; foreach (var segment in elf.Segments) { if (segment.Type == SegmentType.Note) { using (DwarfMemoryReader reader = new DwarfMemoryReader(ReadSegment(segment))) { int noteStructSize = Marshal.SizeOf <elf_32note>(); while (reader.Position + noteStructSize < reader.Data.Length) { // Read note elf_32note note = reader.ReadStructure <elf_32note>(); int nameEnd = reader.Position + (int)note.NameSize; // Check if note is available to be read if (nameEnd + note.n_descsz > reader.Data.Length) { break; } // Read name and content string name = reader.ReadString(); reader.Position = nameEnd; byte[] content = reader.ReadBlock(note.n_descsz); instance.ProcessNote(name, content, note.n_type); if (note.n_type == elf_note_type.File) { using (DwarfMemoryReader data = new DwarfMemoryReader(content)) { files = elf_note_file.Parse(data, Is64bit); } } else if (note.n_type == elf_note_type.Auxv) { using (DwarfMemoryReader data = new DwarfMemoryReader(content)) { uint addressSize = elf.Class == Class.Bit32 ? 4U : 8U; while (!data.IsEnd) { AuxvEntry entry = new AuxvEntry { Type = (AuxvEntryType)data.ReadUlong(addressSize), Value = data.ReadUlong(addressSize) }; if (entry.Type == AuxvEntryType.Null) { break; } if (entry.Type == AuxvEntryType.Ignore) { continue; } auxVector.Add(entry); } } } } } } } DumpFileMemoryReader = new CoreDumpReader(coreDumpPath, elf.Segments.Where(s => s.Type == SegmentType.Load)); }
/// <summary> /// Reads the data for this instance. /// </summary> /// <param name="debugData">The debug data.</param> /// <param name="debugDataDescription">The debug data description.</param> /// <param name="debugStrings">The debug strings.</param> /// <param name="addressNormalizer">Normalize address delegate (<see cref="NormalizeAddressDelegate"/>)</param> private void ReadData(DwarfMemoryReader debugData, DwarfMemoryReader debugDataDescription, DwarfMemoryReader debugStrings, NormalizeAddressDelegate addressNormalizer) { // Read header bool is64bit; int beginPosition = debugData.Position; ulong length = debugData.ReadLength(out is64bit); int endPosition = debugData.Position + (int)length; ushort version = debugData.ReadUshort(); int debugDataDescriptionOffset = debugData.ReadOffset(is64bit); byte addressSize = debugData.ReadByte(); DataDescriptionReader dataDescriptionReader = new DataDescriptionReader(debugDataDescription, debugDataDescriptionOffset); // Read data List <DwarfSymbol> symbols = new List <DwarfSymbol>(); Stack <DwarfSymbol> parents = new Stack <DwarfSymbol>(); while (debugData.Position < endPosition) { int dataPosition = debugData.Position; uint code = debugData.LEB128(); if (code == 0) { parents.Pop(); continue; } DataDescription description = dataDescriptionReader.GetDebugDataDescription(code); Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = new Dictionary <DwarfAttribute, DwarfAttributeValue>(); foreach (DataDescriptionAttribute descriptionAttribute in description.Attributes) { DwarfAttribute attribute = descriptionAttribute.Attribute; DwarfFormat format = descriptionAttribute.Format; DwarfAttributeValue attributeValue = new DwarfAttributeValue(); switch (format) { case DwarfFormat.Address: attributeValue.Type = DwarfAttributeValueType.Address; attributeValue.Value = debugData.ReadUlong(addressSize); break; case DwarfFormat.Block: attributeValue.Type = DwarfAttributeValueType.Block; attributeValue.Value = debugData.ReadBlock(debugData.LEB128()); break; case DwarfFormat.Block1: attributeValue.Type = DwarfAttributeValueType.Block; attributeValue.Value = debugData.ReadBlock(debugData.ReadByte()); break; case DwarfFormat.Block2: attributeValue.Type = DwarfAttributeValueType.Block; attributeValue.Value = debugData.ReadBlock(debugData.ReadUshort()); break; case DwarfFormat.Block4: attributeValue.Type = DwarfAttributeValueType.Block; attributeValue.Value = debugData.ReadBlock(debugData.ReadUint()); break; case DwarfFormat.Data1: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.ReadByte(); break; case DwarfFormat.Data2: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.ReadUshort(); break; case DwarfFormat.Data4: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.ReadUint(); break; case DwarfFormat.Data8: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.ReadUlong(); break; case DwarfFormat.SData: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.SLEB128(); break; case DwarfFormat.UData: attributeValue.Type = DwarfAttributeValueType.Constant; attributeValue.Value = (ulong)debugData.LEB128(); break; case DwarfFormat.String: attributeValue.Type = DwarfAttributeValueType.String; attributeValue.Value = debugData.ReadString(); break; case DwarfFormat.Strp: attributeValue.Type = DwarfAttributeValueType.String; attributeValue.Value = debugStrings.ReadString(debugData.ReadOffset(is64bit)); break; case DwarfFormat.Flag: attributeValue.Type = DwarfAttributeValueType.Flag; attributeValue.Value = debugData.ReadByte() != 0; break; case DwarfFormat.FlagPresent: attributeValue.Type = DwarfAttributeValueType.Flag; attributeValue.Value = true; break; case DwarfFormat.Ref1: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadByte() + (ulong)beginPosition; break; case DwarfFormat.Ref2: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadUshort() + (ulong)beginPosition; break; case DwarfFormat.Ref4: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadUint() + (ulong)beginPosition; break; case DwarfFormat.Ref8: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadUlong() + (ulong)beginPosition; break; case DwarfFormat.RefUData: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.LEB128() + (ulong)beginPosition; break; case DwarfFormat.RefAddr: attributeValue.Type = DwarfAttributeValueType.Reference; attributeValue.Value = (ulong)debugData.ReadOffset(is64bit); break; case DwarfFormat.RefSig8: attributeValue.Type = DwarfAttributeValueType.Invalid; debugData.Position += 8; break; case DwarfFormat.ExpressionLocation: attributeValue.Type = DwarfAttributeValueType.ExpressionLocation; attributeValue.Value = debugData.ReadBlock(debugData.LEB128()); break; case DwarfFormat.SecOffset: attributeValue.Type = DwarfAttributeValueType.SecOffset; attributeValue.Value = (ulong)debugData.ReadOffset(is64bit); break; default: throw new Exception($"Unsupported DwarfFormat: {format}"); } if (attributes.ContainsKey(attribute)) { if (attributes[attribute] != attributeValue) { attributes[attribute] = attributeValue; } } else { attributes.Add(attribute, attributeValue); } } DwarfSymbol symbol = new DwarfSymbol() { Tag = description.Tag, Attributes = attributes, Offset = dataPosition, }; symbolsByOffset.Add(symbol.Offset, symbol); if (parents.Count > 0) { parents.Peek().Children.Add(symbol); symbol.Parent = parents.Peek(); } else { symbols.Add(symbol); } if (description.HasChildren) { symbol.Children = new List <DwarfSymbol>(); parents.Push(symbol); } } SymbolsTree = symbols.ToArray(); if (SymbolsTree.Length > 0) { // Add void type symbol DwarfSymbol voidSymbol = new DwarfSymbol() { Tag = DwarfTag.BaseType, Offset = -1, Parent = SymbolsTree[0], Attributes = new Dictionary <DwarfAttribute, DwarfAttributeValue>() { { DwarfAttribute.Name, new DwarfAttributeValue() { Type = DwarfAttributeValueType.String, Value = "void" } }, { DwarfAttribute.ByteSize, new DwarfAttributeValue() { Type = DwarfAttributeValueType.Constant, Value = (ulong)0 } }, }, }; if (SymbolsTree[0].Children == null) { SymbolsTree[0].Children = new List <DwarfSymbol>(); } SymbolsTree[0].Children.Insert(0, voidSymbol); symbolsByOffset.Add(voidSymbol.Offset, voidSymbol); // Post process all symbols foreach (DwarfSymbol symbol in Symbols) { Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = symbol.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>; foreach (DwarfAttributeValue value in attributes.Values) { if (value.Type == DwarfAttributeValueType.Reference) { DwarfSymbol reference; if (symbolsByOffset.TryGetValue((int)value.Address, out reference)) { value.Type = DwarfAttributeValueType.ResolvedReference; value.Value = reference; } } else if (value.Type == DwarfAttributeValueType.Address) { value.Value = addressNormalizer(value.Address); } } if ((symbol.Tag == DwarfTag.PointerType && !attributes.ContainsKey(DwarfAttribute.Type)) || (symbol.Tag == DwarfTag.Typedef && !attributes.ContainsKey(DwarfAttribute.Type))) { attributes.Add(DwarfAttribute.Type, new DwarfAttributeValue() { Type = DwarfAttributeValueType.ResolvedReference, Value = voidSymbol, }); } } // Merge specifications foreach (DwarfSymbol symbol in Symbols) { Dictionary <DwarfAttribute, DwarfAttributeValue> attributes = symbol.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>; DwarfAttributeValue specificationValue; if (attributes.TryGetValue(DwarfAttribute.Specification, out specificationValue) && specificationValue.Type == DwarfAttributeValueType.ResolvedReference) { DwarfSymbol reference = specificationValue.Reference; Dictionary <DwarfAttribute, DwarfAttributeValue> referenceAttributes = reference.Attributes as Dictionary <DwarfAttribute, DwarfAttributeValue>; foreach (KeyValuePair <DwarfAttribute, DwarfAttributeValue> kvp in attributes) { if (kvp.Key != DwarfAttribute.Specification) { referenceAttributes[kvp.Key] = kvp.Value; } } } } } }