wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-12-23 13:22:58 +03:00
Code Issues Projects Releases Wiki Activity

elf: Basic program header notes decoding

Browse Source 
Used in coredump to record various statees but also used in executables.

Next step would be to decode the note descriptions, like register info, file mappings etc.
Maybe a bit tricky as it is os/abi specific.
This commit is contained in:
Mattias Wadman 2022-09-09 12:42:00 +02:00
parent 2a5a53447c
commit 5382d46a9a
14 changed files with 1029 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

221
format/elf/elf.go
View File

@ -4,6 +4,7 @@ package elf
// https://refspecs.linuxbase.org/elf/gabi4+/contents.html
// https://man7.org/linux/man-pages/man5/elf.5.html
// https://github.com/torvalds/linux/blob/master/include/uapi/linux/elf.h
// https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=include/elf/external.h;hb=HEAD
// TODO: dwarf
@ -63,12 +64,20 @@ var osABINames = scalar.UToSymStr{
255: "standalone",
}
const (
ET_NONE = 0
ET_REL = 1
ET_EXEC = 2
ET_DYN = 3
ET_CORE = 4
)
var typeNames = scalar.URangeToScalar{
{Range: [2]uint64{0x00, 0x00}, S: scalar.S{Sym: "none"}},
{Range: [2]uint64{0x01, 0x01}, S: scalar.S{Sym: "rel"}},
{Range: [2]uint64{0x02, 0x02}, S: scalar.S{Sym: "exec"}},
{Range: [2]uint64{0x03, 0x03}, S: scalar.S{Sym: "dyn"}},
{Range: [2]uint64{0x04, 0x04}, S: scalar.S{Sym: "core"}},
{Range: [2]uint64{ET_NONE, ET_NONE}, S: scalar.S{Sym: "none"}},
{Range: [2]uint64{ET_REL, ET_REL}, S: scalar.S{Sym: "rel"}},
{Range: [2]uint64{ET_EXEC, ET_EXEC}, S: scalar.S{Sym: "exec"}},
{Range: [2]uint64{ET_DYN, ET_DYN}, S: scalar.S{Sym: "dyn"}},
{Range: [2]uint64{ET_CORE, ET_CORE}, S: scalar.S{Sym: "core"}},
{Range: [2]uint64{0xfe00, 0xfeff}, S: scalar.S{Sym: "os"}},
{Range: [2]uint64{0xff00, 0xffff}, S: scalar.S{Sym: "proc"}},
}
@ -131,15 +140,26 @@ var machineNames = scalar.UToScalar{
0x101: {Sym: "wdc_65C816", Description: "WDC 65C816"},
}
const (
PT_NULL = 0
PT_LOAD = 1
PT_DYNAMIC = 2
PT_INTERP = 3
PT_NOTE = 4
PT_SHLIB = 5
PT_PHDR = 6
PT_TLS = 7
)
var phTypeNames = scalar.URangeToScalar{
{Range: [2]uint64{0x00000000, 0x00000000}, S: scalar.S{Sym: "null", Description: "Unused element"}},
{Range: [2]uint64{0x00000001, 0x00000001}, S: scalar.S{Sym: "load", Description: "Loadable segment"}},
{Range: [2]uint64{0x00000002, 0x00000002}, S: scalar.S{Sym: "dynamic", Description: "Dynamic linking information"}},
{Range: [2]uint64{0x00000003, 0x00000003}, S: scalar.S{Sym: "interp", Description: "Interpreter to invoke"}},
{Range: [2]uint64{0x00000004, 0x00000004}, S: scalar.S{Sym: "note", Description: "Auxiliary information"}},
{Range: [2]uint64{0x00000005, 0x00000005}, S: scalar.S{Sym: "shlib", Description: "Reserved but has unspecified"}},
{Range: [2]uint64{0x00000006, 0x00000006}, S: scalar.S{Sym: "phdr", Description: "Program header location and size"}},
{Range: [2]uint64{0x00000007, 0x00000007}, S: scalar.S{Sym: "tls", Description: "Thread-Local Storage template"}},
{Range: [2]uint64{PT_NULL, PT_NULL}, S: scalar.S{Sym: "null", Description: "Unused element"}},
{Range: [2]uint64{PT_LOAD, PT_LOAD}, S: scalar.S{Sym: "load", Description: "Loadable segment"}},
{Range: [2]uint64{PT_DYNAMIC, PT_DYNAMIC}, S: scalar.S{Sym: "dynamic", Description: "Dynamic linking information"}},
{Range: [2]uint64{PT_INTERP, PT_INTERP}, S: scalar.S{Sym: "interp", Description: "Interpreter to invoke"}},
{Range: [2]uint64{PT_NOTE, PT_NOTE}, S: scalar.S{Sym: "note", Description: "Auxiliary information"}},
{Range: [2]uint64{PT_SHLIB, PT_SHLIB}, S: scalar.S{Sym: "shlib", Description: "Reserved but has unspecified"}},
{Range: [2]uint64{PT_PHDR, PT_PHDR}, S: scalar.S{Sym: "phdr", Description: "Program header location and size"}},
{Range: [2]uint64{PT_TLS, PT_TLS}, S: scalar.S{Sym: "tls", Description: "Thread-Local Storage template"}},
{Range: [2]uint64{0x6474e550, 0x6474e550}, S: scalar.S{Sym: "gnu_eh_frame", Description: "GNU frame unwind information"}},
{Range: [2]uint64{0x6474e551, 0x6474e551}, S: scalar.S{Sym: "gnu_stack", Description: "GNU stack permission"}},
{Range: [2]uint64{0x6474e552, 0x6474e552}, S: scalar.S{Sym: "gnu_relro", Description: "GNU read-only after relocation"}},
@ -147,6 +167,143 @@ var phTypeNames = scalar.URangeToScalar{
{Range: [2]uint64{0x70000000, 0x7fffffff}, S: scalar.S{Sym: "proc", Description: "Processor-specific"}},
}
const (
NT_PRSTATUS = 1
NT_PRFPREG = 2
NT_PRPSINFO = 3
NT_TASKSTRUCT = 4
NT_AUXV = 6
NT_SIGINFO = 0x53494749 // "SIGI"
NT_FILE = 0x46494c45 // "FILE"
NT_PRXFPREG = 0x46e62b7f
NT_PPC_VMX = 0x100
NT_PPC_SPE = 0x101
NT_PPC_VSX = 0x102
NT_PPC_TAR = 0x103
NT_PPC_PPR = 0x104
NT_PPC_DSCR = 0x105
NT_PPC_EBB = 0x106
NT_PPC_PMU = 0x107
NT_PPC_TM_CGPR = 0x108
NT_PPC_TM_CFPR = 0x109
NT_PPC_TM_CVMX = 0x10a
NT_PPC_TM_CVSX = 0x10b
NT_PPC_TM_SPR = 0x10c
NT_PPC_TM_CTAR = 0x10d
NT_PPC_TM_CPPR = 0x10e
NT_PPC_TM_CDSCR = 0x10f
NT_PPC_PKEY = 0x110
NT_386_TLS = 0x200
NT_386_IOPERM = 0x201
NT_X86_XSTATE = 0x202
NT_S390_HIGH_GPRS = 0x300
NT_S390_TIMER = 0x301
NT_S390_TODCMP = 0x302
NT_S390_TODPREG = 0x303
NT_S390_CTRS = 0x304
NT_S390_PREFIX = 0x305
NT_S390_LAST_BREAK = 0x306
NT_S390_SYSTEM_CALL = 0x307
NT_S390_TDB = 0x308
NT_S390_VXRS_LOW = 0x309
NT_S390_VXRS_HIGH = 0x30a
NT_S390_GS_CB = 0x30b
NT_S390_GS_BC = 0x30c
NT_S390_RI_CB = 0x30d
NT_S390_PV_CPU_DATA = 0x30e
NT_ARM_VFP = 0x400
NT_ARM_TLS = 0x401
NT_ARM_HW_BREAK = 0x402
NT_ARM_HW_WATCH = 0x403
NT_ARM_SYSTEM_CALL = 0x404
NT_ARM_SVE = 0x405
NT_ARM_PAC_MASK = 0x406
NT_ARM_PACA_KEYS = 0x407
NT_ARM_PACG_KEYS = 0x408
NT_ARM_TAGGED_ADDR_CTRL = 0x409
NT_ARM_PAC_ENABLED_KEYS = 0x40a
NT_ARM_SSVE = 0x40b
NT_ARM_ZA = 0x40c
NT_ARC_V2 = 0x600
NT_VMCOREDD = 0x700
NT_MIPS_DSP = 0x800
NT_MIPS_FP_MODE = 0x801
NT_MIPS_MSA = 0x802
NT_LOONGARCH_CPUCFG = 0xa00
NT_LOONGARCH_CSR = 0xa01
NT_LOONGARCH_LSX = 0xa02
NT_LOONGARCH_LASX = 0xa03
NT_LOONGARCH_LBT = 0xa04
)
var coreNoteNames = scalar.UToScalar{
NT_PRSTATUS: {Sym: "prstatus"},
NT_PRFPREG: {Sym: "prfpreg"},
NT_PRPSINFO: {Sym: "prpsinfo"},
NT_TASKSTRUCT: {Sym: "taskstruct"},
NT_AUXV: {Sym: "auxv"},
NT_SIGINFO: {Sym: "siginfo", Description: "Signal info"},
NT_FILE: {Sym: "file", Description: "File info"},
NT_PRXFPREG: {Sym: "prxfpreg"},
NT_PPC_SPE: {Sym: "ppc_spe", Description: "PowerPC SPE/EVR registers"},
NT_PPC_VSX: {Sym: "ppc_vsx", Description: "PowerPC VSX registers"},
NT_PPC_TAR: {Sym: "ppc_tar", Description: "Target Address Register"},
NT_PPC_PPR: {Sym: "ppc_ppr", Description: "Program Priority Register"},
NT_PPC_DSCR: {Sym: "ppc_dscr", Description: "Data Stream Control Register"},
NT_PPC_EBB: {Sym: "ppc_ebb", Description: "Event Based Branch Registers"},
NT_PPC_PMU: {Sym: "ppc_pmu", Description: "Performance Monitor Registers"},
NT_PPC_TM_CGPR: {Sym: "ppc_tm_cgpr", Description: "TM checkpointed GPR Registers"},
NT_PPC_TM_CFPR: {Sym: "ppc_tm_cfpr", Description: "TM checkpointed FPR Registers"},
NT_PPC_TM_CVMX: {Sym: "ppc_tm_cvmx", Description: "TM checkpointed VMX Registers"},
NT_PPC_TM_CVSX: {Sym: "ppc_tm_cvsx", Description: "TM checkpointed VSX Registers"},
NT_PPC_TM_SPR: {Sym: "ppc_tm_spr", Description: "TM Special Purpose Registers"},
NT_PPC_TM_CTAR: {Sym: "ppc_tm_ctar", Description: "TM checkpointed Target Address Register"},
NT_PPC_TM_CPPR: {Sym: "ppc_tm_cppr", Description: "TM checkpointed Program Priority Register"},
NT_PPC_TM_CDSCR: {Sym: "ppc_tm_cdscr", Description: "TM checkpointed Data Stream Control Register"},
NT_PPC_PKEY: {Sym: "ppc_pkey", Description: "Memory Protection Keys registers"},
NT_386_TLS: {Sym: "386_tls", Description: "i386 TLS slots (struct user_desc)"},
NT_386_IOPERM: {Sym: "386_ioperm", Description: "x86 io permission bitmap (1=deny)"},
NT_X86_XSTATE: {Sym: "x86_xstate", Description: "x86 extended state using xsave"},
NT_S390_HIGH_GPRS: {Sym: "s390_high_gprs", Description: "s390 upper register halves"},
NT_S390_TIMER: {Sym: "s390_timer", Description: "s390 timer register"},
NT_S390_TODCMP: {Sym: "s390_todcmp", Description: "s390 TOD clock comparator register"},
NT_S390_TODPREG: {Sym: "s390_todpreg", Description: "s390 TOD programmable register"},
NT_S390_CTRS: {Sym: "s390_ctrs", Description: "s390 control registers"},
NT_S390_PREFIX: {Sym: "s390_prefix", Description: "s390 prefix register"},
NT_S390_LAST_BREAK: {Sym: "s390_last_break", Description: "s390 breaking event address"},
NT_S390_SYSTEM_CALL: {Sym: "s390_system_call", Description: "s390 system call restart data"},
NT_S390_TDB: {Sym: "s390_tdb", Description: "s390 transaction diagnostic block"},
NT_S390_VXRS_LOW: {Sym: "s390_vxrs_low", Description: "s390 vector registers 0-15 upper half"},
NT_S390_VXRS_HIGH: {Sym: "s390_vxrs_high", Description: "s390 vector registers 16-31"},
NT_S390_GS_CB: {Sym: "s390_gs_cb", Description: "s390 guarded storage registers"},
NT_S390_GS_BC: {Sym: "s390_gs_bc", Description: "s390 guarded storage broadcast control block"},
NT_S390_RI_CB: {Sym: "s390_ri_cb", Description: "s390 runtime instrumentation"},
NT_S390_PV_CPU_DATA: {Sym: "s390_pv_cpu_data", Description: "s390 protvirt cpu dump data"},
NT_ARM_VFP: {Sym: "arm_vfp", Description: "ARM VFP/NEON registers"},
NT_ARM_TLS: {Sym: "arm_tls", Description: "ARM TLS register"},
NT_ARM_HW_BREAK: {Sym: "arm_hw_break", Description: "ARM hardware breakpoint registers"},
NT_ARM_HW_WATCH: {Sym: "arm_hw_watch", Description: "ARM hardware watchpoint registers"},
NT_ARM_SYSTEM_CALL: {Sym: "arm_system_call", Description: "ARM system call number"},
NT_ARM_SVE: {Sym: "arm_sve", Description: "ARM Scalable Vector Extension registers"},
NT_ARM_PAC_MASK: {Sym: "arm_pac_mask", Description: "ARM pointer authentication code masks"},
NT_ARM_PACA_KEYS: {Sym: "arm_paca_keys", Description: "ARM pointer authentication address keys"},
NT_ARM_PACG_KEYS: {Sym: "arm_pacg_keys", Description: "ARM pointer authentication generic key"},
NT_ARM_TAGGED_ADDR_CTRL: {Sym: "arm_tagged_addr_ctrl", Description: "arm64 tagged address control (prctl())"},
NT_ARM_PAC_ENABLED_KEYS: {Sym: "arm_pac_enabled_keys", Description: "arm64 ptr auth enabled keys (prctl())"},
NT_ARM_SSVE: {Sym: "arm_ssve", Description: "ARM Streaming SVE registers"},
NT_ARM_ZA: {Sym: "arm_za", Description: "ARM SME ZA registers"},
NT_ARC_V2: {Sym: "arc_v2", Description: "ARCv2 accumulator/extra registers"},
NT_VMCOREDD: {Sym: "vmcoredd", Description: "Vmcore Device Dump Note"},
NT_MIPS_DSP: {Sym: "mips_dsp", Description: "MIPS DSP ASE registers"},
NT_MIPS_FP_MODE: {Sym: "mips_fp_mode", Description: "MIPS floating-point mode"},
NT_MIPS_MSA: {Sym: "mips_msa", Description: "MIPS SIMD registers"},
NT_LOONGARCH_CPUCFG: {Sym: "loongarch_cpucfg", Description: "LoongArch CPU config registers"},
NT_LOONGARCH_CSR: {Sym: "loongarch_csr", Description: "LoongArch control and status registers"},
NT_LOONGARCH_LSX: {Sym: "loongarch_lsx", Description: "LoongArch Loongson SIMD Extension registers"},
NT_LOONGARCH_LASX: {Sym: "loongarch_lasx", Description: "LoongArch Loongson Advanced SIMD Extension registers"},
NT_LOONGARCH_LBT: {Sym: "loongarch_lbt", Description: "LoongArch Loongson Binary Translation registers"},
}
const (
SHT_NULL = 0x0
SHT_PROGBITS = 0x1
@ -602,6 +759,7 @@ func elfReadSectionHeaders(d *decode.D, ec *elfContext) {
type elfContext struct {
archBits int
typ int
machine int
endian decode.Endian
@ -661,7 +819,7 @@ func elfDecodeHeader(d *decode.D, ec *elfContext) {
d.Fatalf("unknown endian %d", endian)
}
d.FieldU16("type", typeNames, scalar.ActualHex)
typ := d.FieldU16("type", typeNames, scalar.ActualHex)
machine := d.FieldU16("machine", machineNames, scalar.ActualHex)
d.FieldU32("version")
d.FieldU("entry", archBits)
@ -677,6 +835,7 @@ func elfDecodeHeader(d *decode.D, ec *elfContext) {
ec.archBits = archBits
ec.endian = d.Endian
ec.typ = int(typ)
ec.machine = int(machine)
ec.phOff = int64(phOff) * 8
ec.phNum = int(phNum)
@ -705,12 +864,13 @@ func elfDecodeProgramHeader(d *decode.D, ec elfContext) {
})
}
var typ uint64
var offset uint64
var size uint64
switch ec.archBits {
case 32:
d.FieldU32("type", phTypeNames)
typ = d.FieldU32("type", phTypeNames)
offset = d.FieldU("offset", ec.archBits, scalar.ActualHex)
d.FieldU("vaddr", ec.archBits, scalar.ActualHex)
d.FieldU("paddr", ec.archBits, scalar.ActualHex)
@ -719,7 +879,7 @@ func elfDecodeProgramHeader(d *decode.D, ec elfContext) {
pFlags(d)
d.FieldU32("align")
case 64:
d.FieldU32("type", phTypeNames)
typ = d.FieldU32("type", phTypeNames)
pFlags(d)
offset = d.FieldU("offset", ec.archBits, scalar.ActualHex)
d.FieldU("vaddr", ec.archBits, scalar.ActualHex)
@ -730,7 +890,36 @@ func elfDecodeProgramHeader(d *decode.D, ec elfContext) {
}
d.RangeFn(int64(offset*8), int64(size*8), func(d *decode.D) {
switch {
case typ == PT_NOTE:
d.FieldArray("notes", func(d *decode.D) {
for !d.End() {
d.FieldStruct("note", func(d *decode.D) {
// elf manpage says this is 32 or 64 bit but it seems it is always 32
// and that is also what readelf external.h says
nameSz := d.FieldU32("n_namesz")
descSz := d.FieldU32("n_descsz")
if ec.typ == ET_CORE {
d.FieldU32("n_type", coreNoteNames, scalar.ActualHex)
} else {
d.FieldU32("n_type", scalar.ActualHex)
}
d.FieldUTF8NullFixedLen("name", int(nameSz))
nameAlign := d.AlignBits(4 * 8)
if nameAlign != 0 {
d.FieldRawLen("name_align", int64(nameAlign))
}
d.FieldRawLen("desc", int64(descSz)*8)
descAlign := d.AlignBits(4 * 8)
if descAlign != 0 {
d.FieldRawLen("decs_align", int64(descAlign))
}
})
}
})
default:
d.FieldRawLen("data", d.BitsLeft())
}
})
}

12
format/elf/testdata/Makefile vendored
View File

@ -1,4 +1,4 @@
TARGETS=libbbb.o libbbb.so libbbb.a a.o a_dynamic a_stripped a_static
TARGETS=libbbb.o libbbb.so libbbb.a a.o a_dynamic a_stripped a_static coredump
all: $(TARGETS)
@ -13,7 +13,7 @@ clean:
rm -f $(TARGETS)
build:
docker run -ti --rm --platform $(PLATFORM) -v "$(PWD):$(PWD)" -w "$(PWD)" alpine:3.15.0 sh -c 'apk add build-base && make'
docker run -ti --rm --platform $(PLATFORM) -v "$(PWD):$(PWD)" -w "$(PWD)" alpine:3.15.0 sh -c 'apk add build-base && ulimit -c unlimited && make'
mkdir -p $(DIR)
mv $(TARGETS) $(DIR)
rm $(DIR)/*.o
@ -23,9 +23,17 @@ libbbb.so: libbbb.o
libbbb.a: libbbb.o
ar ru $@ $+
ranlib $@
a_dynamic: a.o
$(CC) -o $@ $+ -L./ -lbbb
a_stripped: a_dynamic
strip -o $@ $<
a_static: a.o libbbb.a
$(CC) -o $@ $+ libbbb.a
segfault: segfault.o
$(CC) -o $@ $<
coredump: segfault
./segfault ; mv core coredump ; rm -f segfault segfault.o ; exit 0

12
format/elf/testdata/linux_386/a_dynamic.fqtest vendored
View File

@ -150,9 +150,15 @@ $ fq -d elf dv a_dynamic
0x0120| 04 | . | x: false 0x12c.7-0x12c.7 (0.1)
0x0120| 00 00 00| ...| unused1: 0 0x12d-0x12f.7 (3)
0x0130|04 00 00 00 |.... | align: 4 0x130-0x133.7 (4)
0x01c0| 04 00 00 00| ....| data: raw bits 0x1cc-0x1f3.7 (40)
0x01d0|18 00 00 00 05 00 00 00 47 4e 55 00 01 00 01 c0|........GNU.....|
* |until 0x1f3.7 (40) | |
| | | notes[0:1]: 0x1cc-0x1f3.7 (40)
| | | [0]{}: note 0x1cc-0x1f3.7 (40)
0x01c0| 04 00 00 00| ....| n_namesz: 4 0x1cc-0x1cf.7 (4)
0x01d0|18 00 00 00 |.... | n_descsz: 24 0x1d0-0x1d3.7 (4)
0x01d0| 05 00 00 00 | .... | n_type: 0x5 0x1d4-0x1d7.7 (4)
0x01d0| 47 4e 55 00 | GNU. | name: "GNU" 0x1d8-0x1db.7 (4)
0x01d0| 01 00 01 c0| ....| desc: raw bits 0x1dc-0x1f3.7 (24)
0x01e0|04 00 00 00 01 00 00 00 02 00 01 c0 04 00 00 00|................|
0x01f0|00 00 00 00 |.... |
| | | [8]{}: program_header 0x134-0x1f3.7 (192)
0x0130| 53 e5 74 64 | S.td | type: "os" (1685382483) (Operating system-specific) 0x134-0x137.7 (4)
0x0130| cc 01 00 00 | .... | offset: 0x1cc 0x138-0x13b.7 (4)

12
format/elf/testdata/linux_386/a_static.fqtest vendored
View File

@ -152,9 +152,15 @@ $ fq -d elf dv a_static
0x0120| 04 | . | x: false 0x12c.7-0x12c.7 (0.1)
0x0120| 00 00 00| ...| unused1: 0 0x12d-0x12f.7 (3)
0x0130|04 00 00 00 |.... | align: 4 0x130-0x133.7 (4)
0x01c0| 04 00 00 00| ....| data: raw bits 0x1cc-0x1f3.7 (40)
0x01d0|18 00 00 00 05 00 00 00 47 4e 55 00 01 00 01 c0|........GNU.....|
* |until 0x1f3.7 (40) | |
| | | notes[0:1]: 0x1cc-0x1f3.7 (40)
| | | [0]{}: note 0x1cc-0x1f3.7 (40)
0x01c0| 04 00 00 00| ....| n_namesz: 4 0x1cc-0x1cf.7 (4)
0x01d0|18 00 00 00 |.... | n_descsz: 24 0x1d0-0x1d3.7 (4)
0x01d0| 05 00 00 00 | .... | n_type: 0x5 0x1d4-0x1d7.7 (4)
0x01d0| 47 4e 55 00 | GNU. | name: "GNU" 0x1d8-0x1db.7 (4)
0x01d0| 01 00 01 c0| ....| desc: raw bits 0x1dc-0x1f3.7 (24)
0x01e0|04 00 00 00 01 00 00 00 02 00 01 c0 04 00 00 00|................|
0x01f0|00 00 00 00 |.... |
| | | [8]{}: program_header 0x134-0x1f3.7 (192)
0x0130| 53 e5 74 64 | S.td | type: "os" (1685382483) (Operating system-specific) 0x134-0x137.7 (4)
0x0130| cc 01 00 00 | .... | offset: 0x1cc 0x138-0x13b.7 (4)

12
format/elf/testdata/linux_386/a_stripped.fqtest vendored
View File

@ -150,9 +150,15 @@ $ fq -d elf dv a_stripped
0x0120| 04 | . | x: false 0x12c.7-0x12c.7 (0.1)
0x0120| 00 00 00| ...| unused1: 0 0x12d-0x12f.7 (3)
0x0130|04 00 00 00 |.... | align: 4 0x130-0x133.7 (4)
0x01c0| 04 00 00 00| ....| data: raw bits 0x1cc-0x1f3.7 (40)
0x01d0|18 00 00 00 05 00 00 00 47 4e 55 00 01 00 01 c0|........GNU.....|
* |until 0x1f3.7 (40) | |
| | | notes[0:1]: 0x1cc-0x1f3.7 (40)
| | | [0]{}: note 0x1cc-0x1f3.7 (40)
0x01c0| 04 00 00 00| ....| n_namesz: 4 0x1cc-0x1cf.7 (4)
0x01d0|18 00 00 00 |.... | n_descsz: 24 0x1d0-0x1d3.7 (4)
0x01d0| 05 00 00 00 | .... | n_type: 0x5 0x1d4-0x1d7.7 (4)
0x01d0| 47 4e 55 00 | GNU. | name: "GNU" 0x1d8-0x1db.7 (4)
0x01d0| 01 00 01 c0| ....| desc: raw bits 0x1dc-0x1f3.7 (24)
0x01e0|04 00 00 00 01 00 00 00 02 00 01 c0 04 00 00 00|................|
0x01f0|00 00 00 00 |.... |
| | | [8]{}: program_header 0x134-0x1f3.7 (192)
0x0130| 53 e5 74 64 | S.td | type: "os" (1685382483) (Operating system-specific) 0x134-0x137.7 (4)
0x0130| cc 01 00 00 | .... | offset: 0x1cc 0x138-0x13b.7 (4)

BIN
format/elf/testdata/linux_386/coredump vendored Normal file
View File

Binary file not shown.

371
format/elf/testdata/linux_386/coredump.fqtest vendored Normal file
View File

@ -0,0 +1,371 @@
$ fq -d elf dv coredump
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: coredump (elf) 0x0-0x2efff.7 (192512)
| | | header{}: 0x0-0x33.7 (52)
| | | ident{}: 0x0-0xf.7 (16)
0x00000|7f 45 4c 46 |.ELF | magic: raw bits (valid) 0x0-0x3.7 (4)
0x00000| 01 | . | class: 32 (1) 0x4-0x4.7 (1)
0x00000| 01 | . | data: "little_endian" (1) 0x5-0x5.7 (1)
0x00000| 01 | . | version: 1 0x6-0x6.7 (1)
0x00000| 00 | . | os_abi: "sysv" (0) 0x7-0x7.7 (1)
0x00000| 00 | . | abi_version: 0 0x8-0x8.7 (1)
0x00000| 00 00 00 00 00 00 00| .......| pad: raw bits (all zero) 0x9-0xf.7 (7)
0x00010|04 00 |.. | type: "core" (0x4) 0x10-0x11.7 (2)
0x00010| 03 00 | .. | machine: "x86" (0x3) (x86) 0x12-0x13.7 (2)
0x00010| 01 00 00 00 | .... | version: 1 0x14-0x17.7 (4)
0x00010| 00 00 00 00 | .... | entry: 0 0x18-0x1b.7 (4)
0x00010| 34 00 00 00| 4...| phoff: 52 0x1c-0x1f.7 (4)
0x00020|00 00 00 00 |.... | shoff: 0 0x20-0x23.7 (4)
0x00020| 00 00 00 00 | .... | flags: 0 0x24-0x27.7 (4)
0x00020| 34 00 | 4. | ehsize: 52 0x28-0x29.7 (2)
0x00020| 20 00 | . | phentsize: 32 0x2a-0x2b.7 (2)
0x00020| 11 00 | .. | phnum: 17 0x2c-0x2d.7 (2)
0x00020| 00 00| ..| shentsize: 0 0x2e-0x2f.7 (2)
0x00030|00 00 |.. | shnum: 0 0x30-0x31.7 (2)
0x00030| 00 00 | .. | shstrndx: 0 0x32-0x33.7 (2)
| | | program_headers[0:17]: 0x34-0x2efff.7 (192460)
| | | [0]{}: program_header 0x34-0xcff.7 (3276)
0x00030| 04 00 00 00 | .... | type: "note" (4) (Auxiliary information) 0x34-0x37.7 (4)
0x00030| 54 02 00 00 | T... | offset: 0x254 0x38-0x3b.7 (4)
0x00030| 00 00 00 00| ....| vaddr: 0x0 0x3c-0x3f.7 (4)
0x00040|00 00 00 00 |.... | paddr: 0x0 0x40-0x43.7 (4)
0x00040| ac 0a 00 00 | .... | filesz: 2732 0x44-0x47.7 (4)
0x00040| 00 00 00 00 | .... | memsz: 0 0x48-0x4b.7 (4)
| | | flags{}: 0x4c-0x4f.7 (4)
0x00040| 00 | . | unused0: 0 0x4c-0x4c.4 (0.5)
0x00040| 00 | . | r: false 0x4c.5-0x4c.5 (0.1)
0x00040| 00 | . | w: false 0x4c.6-0x4c.6 (0.1)
0x00040| 00 | . | x: false 0x4c.7-0x4c.7 (0.1)
0x00040| 00 00 00| ...| unused1: 0 0x4d-0x4f.7 (3)
0x00050|00 00 00 00 |.... | align: 0 0x50-0x53.7 (4)
| | | notes[0:9]: 0x254-0xcff.7 (2732)
| | | [0]{}: note 0x254-0x2f7.7 (164)
0x00250| 05 00 00 00 | .... | n_namesz: 5 0x254-0x257.7 (4)
0x00250| 90 00 00 00 | .... | n_descsz: 144 0x258-0x25b.7 (4)
0x00250| 01 00 00 00| ....| n_type: "prstatus" (0x1) 0x25c-0x25f.7 (4)
0x00260|43 4f 52 45 00 |CORE. | name: "CORE" 0x260-0x264.7 (5)
0x00260| 00 00 00 | ... | name_align: raw bits 0x265-0x267.7 (3)
0x00260| 0b 00 00 00 00 00 00 00| ........| desc: raw bits 0x268-0x2f7.7 (144)
0x00270|00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x2f7.7 (144) | |
| | | [1]{}: note 0x2f8-0x387.7 (144)
0x002f0| 05 00 00 00 | .... | n_namesz: 5 0x2f8-0x2fb.7 (4)
0x002f0| 7c 00 00 00| |...| n_descsz: 124 0x2fc-0x2ff.7 (4)
0x00300|03 00 00 00 |.... | n_type: "prpsinfo" (0x3) 0x300-0x303.7 (4)
0x00300| 43 4f 52 45 00 | CORE. | name: "CORE" 0x304-0x308.7 (5)
0x00300| 00 00 00 | ... | name_align: raw bits 0x309-0x30b.7 (3)
0x00300| 00 52 00 00| .R..| desc: raw bits 0x30c-0x387.7 (124)
0x00310|00 06 40 00 00 00 00 00 24 00 00 00 23 00 00 00|..@.....$...#...|
* |until 0x387.7 (124) | |
| | | [2]{}: note 0x388-0x41b.7 (148)
0x00380| 05 00 00 00 | .... | n_namesz: 5 0x388-0x38b.7 (4)
0x00380| 80 00 00 00| ....| n_descsz: 128 0x38c-0x38f.7 (4)
0x00390|49 47 49 53 |IGIS | n_type: "siginfo" (0x53494749) (Signal info) 0x390-0x393.7 (4)
0x00390| 43 4f 52 45 00 | CORE. | name: "CORE" 0x394-0x398.7 (5)
0x00390| 00 00 00 | ... | name_align: raw bits 0x399-0x39b.7 (3)
0x00390| 0b 00 00 00| ....| desc: raw bits 0x39c-0x41b.7 (128)
0x003a0|00 00 00 00 01 00 00 00 44 33 22 11 00 00 00 00|........D3".....|
* |until 0x41b.7 (128) | |
| | | [3]{}: note 0x41c-0x4d7.7 (188)
0x00410| 05 00 00 00| ....| n_namesz: 5 0x41c-0x41f.7 (4)
0x00420|a8 00 00 00 |.... | n_descsz: 168 0x420-0x423.7 (4)
0x00420| 06 00 00 00 | .... | n_type: "auxv" (0x6) 0x424-0x427.7 (4)
0x00420| 43 4f 52 45 00 | CORE. | name: "CORE" 0x428-0x42c.7 (5)
0x00420| 00 00 00| ...| name_align: raw bits 0x42d-0x42f.7 (3)
0x00430|20 00 00 00 40 e5 f5 f7 21 00 00 00 00 e0 f5 f7| ...@...!.......| desc: raw bits 0x430-0x4d7.7 (168)
* |until 0x4d7.7 (168) | |
| | | [4]{}: note 0x4d8-0x6d3.7 (508)
0x004d0| 05 00 00 00 | .... | n_namesz: 5 0x4d8-0x4db.7 (4)
0x004d0| e8 01 00 00| ....| n_descsz: 488 0x4dc-0x4df.7 (4)
0x004e0|45 4c 49 46 |ELIF | n_type: "file" (0x46494c45) (File info) 0x4e0-0x4e3.7 (4)
0x004e0| 43 4f 52 45 00 | CORE. | name: "CORE" 0x4e4-0x4e8.7 (5)
0x004e0| 00 00 00 | ... | name_align: raw bits 0x4e9-0x4eb.7 (3)
0x004e0| 0a 00 00 00| ....| desc: raw bits 0x4ec-0x6d3.7 (488)
0x004f0|00 10 00 00 00 80 59 56 00 90 59 56 00 00 00 00|......YV..YV....|
* |until 0x6d3.7 (488) | |
| | | [5]{}: note 0x6d4-0x753.7 (128)
0x006d0| 05 00 00 00 | .... | n_namesz: 5 0x6d4-0x6d7.7 (4)
0x006d0| 6c 00 00 00 | l... | n_descsz: 108 0x6d8-0x6db.7 (4)
0x006d0| 02 00 00 00| ....| n_type: "prfpreg" (0x2) 0x6dc-0x6df.7 (4)
0x006e0|43 4f 52 45 00 |CORE. | name: "CORE" 0x6e0-0x6e4.7 (5)
0x006e0| 00 00 00 | ... | name_align: raw bits 0x6e5-0x6e7.7 (3)
0x006e0| 7f 03 ff ff 00 00 ff ff| ........| desc: raw bits 0x6e8-0x753.7 (108)
0x006f0|ff ff ff ff 00 00 00 00 23 00 00 00 00 00 00 00|........#.......|
* |until 0x753.7 (108) | |
| | | [6]{}: note 0x754-0x967.7 (532)
0x00750| 06 00 00 00 | .... | n_namesz: 6 0x754-0x757.7 (4)
0x00750| 00 02 00 00 | .... | n_descsz: 512 0x758-0x75b.7 (4)
0x00750| 7f 2b e6 46| .+.F| n_type: "prxfpreg" (0x46e62b7f) 0x75c-0x75f.7 (4)
0x00760|4c 49 4e 55 58 00 |LINUX. | name: "LINUX" 0x760-0x765.7 (6)
0x00760| 00 00 | .. | name_align: raw bits 0x766-0x767.7 (2)
0x00760| 7f 03 00 00 00 00 00 00| ........| desc: raw bits 0x768-0x967.7 (512)
0x00770|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x967.7 (512) | |
| | | [7]{}: note 0x968-0xcbb.7 (852)
0x00960| 06 00 00 00 | .... | n_namesz: 6 0x968-0x96b.7 (4)
0x00960| 40 03 00 00| @...| n_descsz: 832 0x96c-0x96f.7 (4)
0x00970|02 02 00 00 |.... | n_type: "x86_xstate" (0x202) (x86 extended state using xsave) 0x970-0x973.7 (4)
0x00970| 4c 49 4e 55 58 00 | LINUX. | name: "LINUX" 0x974-0x979.7 (6)
0x00970| 00 00 | .. | name_align: raw bits 0x97a-0x97b.7 (2)
0x00970| 7f 03 00 00| ....| desc: raw bits 0x97c-0xcbb.7 (832)
0x00980|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0xcbb.7 (832) | |
| | | [8]{}: note 0xcbc-0xcff.7 (68)
0x00cb0| 06 00 00 00| ....| n_namesz: 6 0xcbc-0xcbf.7 (4)
0x00cc0|30 00 00 00 |0... | n_descsz: 48 0xcc0-0xcc3.7 (4)
0x00cc0| 00 02 00 00 | .... | n_type: "386_tls" (0x200) (i386 TLS slots (struct user_desc)) 0xcc4-0xcc7.7 (4)
0x00cc0| 4c 49 4e 55 58 00 | LINUX. | name: "LINUX" 0xcc8-0xccd.7 (6)
0x00cc0| 00 00| ..| name_align: raw bits 0xcce-0xccf.7 (2)
0x00cd0|0c 00 00 00 84 7c ff f7 ff ff 0f 00 51 00 00 00|.....|......Q...| desc: raw bits 0xcd0-0xcff.7 (48)
* |until 0xcff.7 (48) | |
| | | [1]{}: program_header 0x54-0xfff.7 (4012)
0x00050| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x54-0x57.7 (4)
0x00050| 00 10 00 00 | .... | offset: 0x1000 0x58-0x5b.7 (4)
0x00050| 00 80 59 56| ..YV| vaddr: 0x56598000 0x5c-0x5f.7 (4)
0x00060|00 00 00 00 |.... | paddr: 0x0 0x60-0x63.7 (4)
0x00060| 00 00 00 00 | .... | filesz: 0 0x64-0x67.7 (4)
0x00060| 00 10 00 00 | .... | memsz: 4096 0x68-0x6b.7 (4)
| | | flags{}: 0x6c-0x6f.7 (4)
0x00060| 04 | . | unused0: 0 0x6c-0x6c.4 (0.5)
0x00060| 04 | . | r: true 0x6c.5-0x6c.5 (0.1)
0x00060| 04 | . | w: false 0x6c.6-0x6c.6 (0.1)
0x00060| 04 | . | x: false 0x6c.7-0x6c.7 (0.1)
0x00060| 00 00 00| ...| unused1: 0 0x6d-0x6f.7 (3)
0x00070|00 10 00 00 |.... | align: 4096 0x70-0x73.7 (4)
| | | data: raw bits 0x1000-NA (0)
| | | [2]{}: program_header 0x74-0xfff.7 (3980)
0x00070| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x74-0x77.7 (4)
0x00070| 00 10 00 00 | .... | offset: 0x1000 0x78-0x7b.7 (4)
0x00070| 00 90 59 56| ..YV| vaddr: 0x56599000 0x7c-0x7f.7 (4)
0x00080|00 00 00 00 |.... | paddr: 0x0 0x80-0x83.7 (4)
0x00080| 00 00 00 00 | .... | filesz: 0 0x84-0x87.7 (4)
0x00080| 00 10 00 00 | .... | memsz: 4096 0x88-0x8b.7 (4)
| | | flags{}: 0x8c-0x8f.7 (4)
0x00080| 05 | . | unused0: 0 0x8c-0x8c.4 (0.5)
0x00080| 05 | . | r: true 0x8c.5-0x8c.5 (0.1)
0x00080| 05 | . | w: false 0x8c.6-0x8c.6 (0.1)
0x00080| 05 | . | x: true 0x8c.7-0x8c.7 (0.1)
0x00080| 00 00 00| ...| unused1: 0 0x8d-0x8f.7 (3)
0x00090|00 10 00 00 |.... | align: 4096 0x90-0x93.7 (4)
| | | data: raw bits 0x1000-NA (0)
| | | [3]{}: program_header 0x94-0xfff.7 (3948)
0x00090| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x94-0x97.7 (4)
0x00090| 00 10 00 00 | .... | offset: 0x1000 0x98-0x9b.7 (4)
0x00090| 00 a0 59 56| ..YV| vaddr: 0x5659a000 0x9c-0x9f.7 (4)
0x000a0|00 00 00 00 |.... | paddr: 0x0 0xa0-0xa3.7 (4)
0x000a0| 00 00 00 00 | .... | filesz: 0 0xa4-0xa7.7 (4)
0x000a0| 00 10 00 00 | .... | memsz: 4096 0xa8-0xab.7 (4)
| | | flags{}: 0xac-0xaf.7 (4)
0x000a0| 04 | . | unused0: 0 0xac-0xac.4 (0.5)
0x000a0| 04 | . | r: true 0xac.5-0xac.5 (0.1)
0x000a0| 04 | . | w: false 0xac.6-0xac.6 (0.1)
0x000a0| 04 | . | x: false 0xac.7-0xac.7 (0.1)
0x000a0| 00 00 00| ...| unused1: 0 0xad-0xaf.7 (3)
0x000b0|00 10 00 00 |.... | align: 4096 0xb0-0xb3.7 (4)
| | | data: raw bits 0x1000-NA (0)
| | | [4]{}: program_header 0xb4-0x1fff.7 (8012)
0x000b0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0xb4-0xb7.7 (4)
0x000b0| 00 10 00 00 | .... | offset: 0x1000 0xb8-0xbb.7 (4)
0x000b0| 00 b0 59 56| ..YV| vaddr: 0x5659b000 0xbc-0xbf.7 (4)
0x000c0|00 00 00 00 |.... | paddr: 0x0 0xc0-0xc3.7 (4)
0x000c0| 00 10 00 00 | .... | filesz: 4096 0xc4-0xc7.7 (4)
0x000c0| 00 10 00 00 | .... | memsz: 4096 0xc8-0xcb.7 (4)
| | | flags{}: 0xcc-0xcf.7 (4)
0x000c0| 04 | . | unused0: 0 0xcc-0xcc.4 (0.5)
0x000c0| 04 | . | r: true 0xcc.5-0xcc.5 (0.1)
0x000c0| 04 | . | w: false 0xcc.6-0xcc.6 (0.1)
0x000c0| 04 | . | x: false 0xcc.7-0xcc.7 (0.1)
0x000c0| 00 00 00| ...| unused1: 0 0xcd-0xcf.7 (3)
0x000d0|00 10 00 00 |.... | align: 4096 0xd0-0xd3.7 (4)
0x01000|01 1b 03 3b 28 00 00 00 04 00 00 00 20 f0 ff ff|...;(....... ...| data: raw bits 0x1000-0x1fff.7 (4096)
* |until 0x1fff.7 (4096) | |
| | | [5]{}: program_header 0xd4-0x2fff.7 (12076)
0x000d0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0xd4-0xd7.7 (4)
0x000d0| 00 20 00 00 | . .. | offset: 0x2000 0xd8-0xdb.7 (4)
0x000d0| 00 c0 59 56| ..YV| vaddr: 0x5659c000 0xdc-0xdf.7 (4)
0x000e0|00 00 00 00 |.... | paddr: 0x0 0xe0-0xe3.7 (4)
0x000e0| 00 10 00 00 | .... | filesz: 4096 0xe4-0xe7.7 (4)
0x000e0| 00 10 00 00 | .... | memsz: 4096 0xe8-0xeb.7 (4)
| | | flags{}: 0xec-0xef.7 (4)
0x000e0| 06 | . | unused0: 0 0xec-0xec.4 (0.5)
0x000e0| 06 | . | r: true 0xec.5-0xec.5 (0.1)
0x000e0| 06 | . | w: true 0xec.6-0xec.6 (0.1)
0x000e0| 06 | . | x: false 0xec.7-0xec.7 (0.1)
0x000e0| 00 00 00| ...| unused1: 0 0xed-0xef.7 (3)
0x000f0|00 10 00 00 |.... | align: 4096 0xf0-0xf3.7 (4)
0x02000|00 c0 59 56 00 00 00 00 00 00 00 00 00 00 00 00|..YV............| data: raw bits 0x2000-0x2fff.7 (4096)
* |until 0x2fff.7 (4096) | |
| | | [6]{}: program_header 0xf4-0x2fff.7 (12044)
0x000f0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0xf4-0xf7.7 (4)
0x000f0| 00 30 00 00 | .0.. | offset: 0x3000 0xf8-0xfb.7 (4)
0x000f0| 00 90 95 56| ...V| vaddr: 0x56959000 0xfc-0xff.7 (4)
0x00100|00 00 00 00 |.... | paddr: 0x0 0x100-0x103.7 (4)
0x00100| 00 00 00 00 | .... | filesz: 0 0x104-0x107.7 (4)
0x00100| 00 10 00 00 | .... | memsz: 4096 0x108-0x10b.7 (4)
| | | flags{}: 0x10c-0x10f.7 (4)
0x00100| 00 | . | unused0: 0 0x10c-0x10c.4 (0.5)
0x00100| 00 | . | r: false 0x10c.5-0x10c.5 (0.1)
0x00100| 00 | . | w: false 0x10c.6-0x10c.6 (0.1)
0x00100| 00 | . | x: false 0x10c.7-0x10c.7 (0.1)
0x00100| 00 00 00| ...| unused1: 0 0x10d-0x10f.7 (3)
0x00110|00 10 00 00 |.... | align: 4096 0x110-0x113.7 (4)
| | | data: raw bits 0x3000-NA (0)
| | | [7]{}: program_header 0x114-0x3fff.7 (16108)
0x00110| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x114-0x117.7 (4)
0x00110| 00 30 00 00 | .0.. | offset: 0x3000 0x118-0x11b.7 (4)
0x00110| 00 a0 95 56| ...V| vaddr: 0x5695a000 0x11c-0x11f.7 (4)
0x00120|00 00 00 00 |.... | paddr: 0x0 0x120-0x123.7 (4)
0x00120| 00 10 00 00 | .... | filesz: 4096 0x124-0x127.7 (4)
0x00120| 00 10 00 00 | .... | memsz: 4096 0x128-0x12b.7 (4)
| | | flags{}: 0x12c-0x12f.7 (4)
0x00120| 06 | . | unused0: 0 0x12c-0x12c.4 (0.5)
0x00120| 06 | . | r: true 0x12c.5-0x12c.5 (0.1)
0x00120| 06 | . | w: true 0x12c.6-0x12c.6 (0.1)
0x00120| 06 | . | x: false 0x12c.7-0x12c.7 (0.1)
0x00120| 00 00 00| ...| unused1: 0 0x12d-0x12f.7 (3)
0x00130|00 10 00 00 |.... | align: 4096 0x130-0x133.7 (4)
0x03000|e9 ed 4d 0e fe 91 f9 68 00 00 00 00 aa 00 00 00|..M....h........| data: raw bits 0x3000-0x3fff.7 (4096)
* |until 0x3fff.7 (4096) | |
| | | [8]{}: program_header 0x134-0x7fff.7 (32460)
0x00130| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x134-0x137.7 (4)
0x00130| 00 40 00 00 | .@.. | offset: 0x4000 0x138-0x13b.7 (4)
0x00130| 00 a0 f5 f7| ....| vaddr: 0xf7f5a000 0x13c-0x13f.7 (4)
0x00140|00 00 00 00 |.... | paddr: 0x0 0x140-0x143.7 (4)
0x00140| 00 40 00 00 | .@.. | filesz: 16384 0x144-0x147.7 (4)
0x00140| 00 40 00 00 | .@.. | memsz: 16384 0x148-0x14b.7 (4)
| | | flags{}: 0x14c-0x14f.7 (4)
0x00140| 04 | . | unused0: 0 0x14c-0x14c.4 (0.5)
0x00140| 04 | . | r: true 0x14c.5-0x14c.5 (0.1)
0x00140| 04 | . | w: false 0x14c.6-0x14c.6 (0.1)
0x00140| 04 | . | x: false 0x14c.7-0x14c.7 (0.1)
0x00140| 00 00 00| ...| unused1: 0 0x14d-0x14f.7 (3)
0x00150|00 10 00 00 |.... | align: 4096 0x150-0x153.7 (4)
0x04000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0x4000-0x7fff.7 (16384)
* |until 0x7fff.7 (16384) | |
| | | [9]{}: program_header 0x154-0x9fff.7 (40620)
0x00150| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x154-0x157.7 (4)
0x00150| 00 80 00 00 | .... | offset: 0x8000 0x158-0x15b.7 (4)
0x00150| 00 e0 f5 f7| ....| vaddr: 0xf7f5e000 0x15c-0x15f.7 (4)
0x00160|00 00 00 00 |.... | paddr: 0x0 0x160-0x163.7 (4)
0x00160| 00 20 00 00 | . .. | filesz: 8192 0x164-0x167.7 (4)
0x00160| 00 20 00 00 | . .. | memsz: 8192 0x168-0x16b.7 (4)
| | | flags{}: 0x16c-0x16f.7 (4)
0x00160| 05 | . | unused0: 0 0x16c-0x16c.4 (0.5)
0x00160| 05 | . | r: true 0x16c.5-0x16c.5 (0.1)
0x00160| 05 | . | w: false 0x16c.6-0x16c.6 (0.1)
0x00160| 05 | . | x: true 0x16c.7-0x16c.7 (0.1)
0x00160| 00 00 00| ...| unused1: 0 0x16d-0x16f.7 (3)
0x00170|00 10 00 00 |.... | align: 4096 0x170-0x173.7 (4)
0x08000|7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00|.ELF............| data: raw bits 0x8000-0x9fff.7 (8192)
* |until 0x9fff.7 (8192) | |
| | | [10]{}: program_header 0x174-0x9fff.7 (40588)
0x00170| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x174-0x177.7 (4)
0x00170| 00 a0 00 00 | .... | offset: 0xa000 0x178-0x17b.7 (4)
0x00170| 00 00 f6 f7| ....| vaddr: 0xf7f60000 0x17c-0x17f.7 (4)
0x00180|00 00 00 00 |.... | paddr: 0x0 0x180-0x183.7 (4)
0x00180| 00 00 00 00 | .... | filesz: 0 0x184-0x187.7 (4)
0x00180| 00 20 01 00 | . .. | memsz: 73728 0x188-0x18b.7 (4)
| | | flags{}: 0x18c-0x18f.7 (4)
0x00180| 04 | . | unused0: 0 0x18c-0x18c.4 (0.5)
0x00180| 04 | . | r: true 0x18c.5-0x18c.5 (0.1)
0x00180| 04 | . | w: false 0x18c.6-0x18c.6 (0.1)
0x00180| 04 | . | x: false 0x18c.7-0x18c.7 (0.1)
0x00180| 00 00 00| ...| unused1: 0 0x18d-0x18f.7 (3)
0x00190|00 10 00 00 |.... | align: 4096 0x190-0x193.7 (4)
| | | data: raw bits 0xa000-NA (0)
| | | [11]{}: program_header 0x194-0x9fff.7 (40556)
0x00190| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x194-0x197.7 (4)
0x00190| 00 a0 00 00 | .... | offset: 0xa000 0x198-0x19b.7 (4)
0x00190| 00 20 f7 f7| . ..| vaddr: 0xf7f72000 0x19c-0x19f.7 (4)
0x001a0|00 00 00 00 |.... | paddr: 0x0 0x1a0-0x1a3.7 (4)
0x001a0| 00 00 00 00 | .... | filesz: 0 0x1a4-0x1a7.7 (4)
0x001a0| 00 f0 04 00 | .... | memsz: 323584 0x1a8-0x1ab.7 (4)
| | | flags{}: 0x1ac-0x1af.7 (4)
0x001a0| 05 | . | unused0: 0 0x1ac-0x1ac.4 (0.5)
0x001a0| 05 | . | r: true 0x1ac.5-0x1ac.5 (0.1)
0x001a0| 05 | . | w: false 0x1ac.6-0x1ac.6 (0.1)
0x001a0| 05 | . | x: true 0x1ac.7-0x1ac.7 (0.1)
0x001a0| 00 00 00| ...| unused1: 0 0x1ad-0x1af.7 (3)
0x001b0|00 10 00 00 |.... | align: 4096 0x1b0-0x1b3.7 (4)
| | | data: raw bits 0xa000-NA (0)
| | | [12]{}: program_header 0x1b4-0x9fff.7 (40524)
0x001b0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x1b4-0x1b7.7 (4)
0x001b0| 00 a0 00 00 | .... | offset: 0xa000 0x1b8-0x1bb.7 (4)
0x001b0| 00 10 fc f7| ....| vaddr: 0xf7fc1000 0x1bc-0x1bf.7 (4)
0x001c0|00 00 00 00 |.... | paddr: 0x0 0x1c0-0x1c3.7 (4)
0x001c0| 00 00 00 00 | .... | filesz: 0 0x1c4-0x1c7.7 (4)
0x001c0| 00 40 03 00 | .@.. | memsz: 212992 0x1c8-0x1cb.7 (4)
| | | flags{}: 0x1cc-0x1cf.7 (4)
0x001c0| 04 | . | unused0: 0 0x1cc-0x1cc.4 (0.5)
0x001c0| 04 | . | r: true 0x1cc.5-0x1cc.5 (0.1)
0x001c0| 04 | . | w: false 0x1cc.6-0x1cc.6 (0.1)
0x001c0| 04 | . | x: false 0x1cc.7-0x1cc.7 (0.1)
0x001c0| 00 00 00| ...| unused1: 0 0x1cd-0x1cf.7 (3)
0x001d0|00 10 00 00 |.... | align: 4096 0x1d0-0x1d3.7 (4)
| | | data: raw bits 0xa000-NA (0)
| | | [13]{}: program_header 0x1d4-0xafff.7 (44588)
0x001d0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x1d4-0x1d7.7 (4)
0x001d0| 00 a0 00 00 | .... | offset: 0xa000 0x1d8-0x1db.7 (4)
0x001d0| 00 50 ff f7| .P..| vaddr: 0xf7ff5000 0x1dc-0x1df.7 (4)
0x001e0|00 00 00 00 |.... | paddr: 0x0 0x1e0-0x1e3.7 (4)
0x001e0| 00 10 00 00 | .... | filesz: 4096 0x1e4-0x1e7.7 (4)
0x001e0| 00 10 00 00 | .... | memsz: 4096 0x1e8-0x1eb.7 (4)
| | | flags{}: 0x1ec-0x1ef.7 (4)
0x001e0| 04 | . | unused0: 0 0x1ec-0x1ec.4 (0.5)
0x001e0| 04 | . | r: true 0x1ec.5-0x1ec.5 (0.1)
0x001e0| 04 | . | w: false 0x1ec.6-0x1ec.6 (0.1)
0x001e0| 04 | . | x: false 0x1ec.7-0x1ec.7 (0.1)
0x001e0| 00 00 00| ...| unused1: 0 0x1ed-0x1ef.7 (3)
0x001f0|00 10 00 00 |.... | align: 4096 0x1f0-0x1f3.7 (4)
0x0a000|87 02 41 0e 0c 86 03 41 0e 10 83 04 4e 0e 4c 03|..A....A....N.L.| data: raw bits 0xa000-0xafff.7 (4096)
* |until 0xafff.7 (4096) | |
| | | [14]{}: program_header 0x1f4-0xbfff.7 (48652)
0x001f0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x1f4-0x1f7.7 (4)
0x001f0| 00 b0 00 00 | .... | offset: 0xb000 0x1f8-0x1fb.7 (4)
0x001f0| 00 60 ff f7| .`..| vaddr: 0xf7ff6000 0x1fc-0x1ff.7 (4)
0x00200|00 00 00 00 |.... | paddr: 0x0 0x200-0x203.7 (4)
0x00200| 00 10 00 00 | .... | filesz: 4096 0x204-0x207.7 (4)
0x00200| 00 10 00 00 | .... | memsz: 4096 0x208-0x20b.7 (4)
| | | flags{}: 0x20c-0x20f.7 (4)
0x00200| 06 | . | unused0: 0 0x20c-0x20c.4 (0.5)
0x00200| 06 | . | r: true 0x20c.5-0x20c.5 (0.1)
0x00200| 06 | . | w: true 0x20c.6-0x20c.6 (0.1)
0x00200| 06 | . | x: false 0x20c.7-0x20c.7 (0.1)
0x00200| 00 00 00| ...| unused1: 0 0x20d-0x20f.7 (3)
0x00210|00 10 00 00 |.... | align: 4096 0x210-0x213.7 (4)
0x0b000|00 00 00 00 2d f4 51 58 cf 8c b1 c0 46 f6 b5 cb|....-.QX....F...| data: raw bits 0xb000-0xbfff.7 (4096)
* |until 0xbfff.7 (4096) | |
| | | [15]{}: program_header 0x214-0xdfff.7 (56812)
0x00210| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x214-0x217.7 (4)
0x00210| 00 c0 00 00 | .... | offset: 0xc000 0x218-0x21b.7 (4)
0x00210| 00 70 ff f7| .p..| vaddr: 0xf7ff7000 0x21c-0x21f.7 (4)
0x00220|00 00 00 00 |.... | paddr: 0x0 0x220-0x223.7 (4)
0x00220| 00 20 00 00 | . .. | filesz: 8192 0x224-0x227.7 (4)
0x00220| 00 20 00 00 | . .. | memsz: 8192 0x228-0x22b.7 (4)
| | | flags{}: 0x22c-0x22f.7 (4)
0x00220| 06 | . | unused0: 0 0x22c-0x22c.4 (0.5)
0x00220| 06 | . | r: true 0x22c.5-0x22c.5 (0.1)
0x00220| 06 | . | w: true 0x22c.6-0x22c.6 (0.1)
0x00220| 06 | . | x: false 0x22c.7-0x22c.7 (0.1)
0x00220| 00 00 00| ...| unused1: 0 0x22d-0x22f.7 (3)
0x00230|00 10 00 00 |.... | align: 4096 0x230-0x233.7 (4)
0x0c000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0xc000-0xdfff.7 (8192)
* |until 0xdfff.7 (8192) | |
| | | [16]{}: program_header 0x234-0x2efff.7 (191948)
0x00230| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x234-0x237.7 (4)
0x00230| 00 e0 00 00 | .... | offset: 0xe000 0x238-0x23b.7 (4)
0x00230| 00 b0 d5 ff| ....| vaddr: 0xffd5b000 0x23c-0x23f.7 (4)
0x00240|00 00 00 00 |.... | paddr: 0x0 0x240-0x243.7 (4)
0x00240| 00 10 02 00 | .... | filesz: 135168 0x244-0x247.7 (4)
0x00240| 00 10 02 00 | .... | memsz: 135168 0x248-0x24b.7 (4)
| | | flags{}: 0x24c-0x24f.7 (4)
0x00240| 06 | . | unused0: 0 0x24c-0x24c.4 (0.5)
0x00240| 06 | . | r: true 0x24c.5-0x24c.5 (0.1)
0x00240| 06 | . | w: true 0x24c.6-0x24c.6 (0.1)
0x00240| 06 | . | x: false 0x24c.7-0x24c.7 (0.1)
0x00240| 00 00 00| ...| unused1: 0 0x24d-0x24f.7 (3)
0x00250|00 10 00 00 |.... | align: 4096 0x250-0x253.7 (4)
0x0e000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0xe000-0x2efff.7 (135168)
* |until 0x2efff.7 (end) (135168) | |
| | | section_headers[0:0]: 0x254-NA (0)
0x00d00|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| unknown0: raw bits 0xd00-0xfff.7 (768)
* |until 0xfff.7 (768) | |

9
format/elf/testdata/linux_386/libbbb.so.fqtest vendored
View File

@ -119,8 +119,13 @@ $ fq -d elf dv libbbb.so
0x00e0| 04 | . | x: false 0xec.7-0xec.7 (0.1)
0x00e0| 00 00 00| ...| unused1: 0 0xed-0xef.7 (3)
0x00f0|04 00 00 00 |.... | align: 4 0xf0-0xf3.7 (4)
0x20c0| 04 00 00 00 18 00 00 00 05 00 00 00| ............| data: raw bits 0x20c4-0x20eb.7 (40)
0x20d0|47 4e 55 00 01 00 01 c0 04 00 00 00 01 00 00 00|GNU.............|
| | | notes[0:1]: 0x20c4-0x20eb.7 (40)
| | | [0]{}: note 0x20c4-0x20eb.7 (40)
0x20c0| 04 00 00 00 | .... | n_namesz: 4 0x20c4-0x20c7.7 (4)
0x20c0| 18 00 00 00 | .... | n_descsz: 24 0x20c8-0x20cb.7 (4)
0x20c0| 05 00 00 00| ....| n_type: 0x5 0x20cc-0x20cf.7 (4)
0x20d0|47 4e 55 00 |GNU. | name: "GNU" 0x20d0-0x20d3.7 (4)
0x20d0| 01 00 01 c0 04 00 00 00 01 00 00 00| ............| desc: raw bits 0x20d4-0x20eb.7 (24)
0x20e0|02 00 01 c0 04 00 00 00 00 00 00 00 |............ |
| | | [6]{}: program_header 0xf4-0x20eb.7 (8184)
0x00f0| 53 e5 74 64 | S.td | type: "os" (1685382483) (Operating system-specific) 0xf4-0xf7.7 (4)

10
format/elf/testdata/linux_amd64/a_dynamic.fqtest vendored
View File

@ -151,8 +151,14 @@ $ fq -d elf dv a_dynamic
0x01e0| 30 00 00 00 00 00 00 00| 0.......| filesz: 48 0x1e8-0x1ef.7 (8)
0x01f0|30 00 00 00 00 00 00 00 |0....... | memsz: 48 0x1f0-0x1f7.7 (8)
0x01f0| 08 00 00 00 00 00 00 00| ........| align: 8 0x1f8-0x1ff.7 (8)
0x0300|04 00 00 00 20 00 00 00 05 00 00 00 47 4e 55 00|.... .......GNU.| data: raw bits 0x300-0x32f.7 (48)
* |until 0x32f.7 (48) | |
| | | notes[0:1]: 0x300-0x32f.7 (48)
| | | [0]{}: note 0x300-0x32f.7 (48)
0x0300|04 00 00 00 |.... | n_namesz: 4 0x300-0x303.7 (4)
0x0300| 20 00 00 00 | ... | n_descsz: 32 0x304-0x307.7 (4)
0x0300| 05 00 00 00 | .... | n_type: 0x5 0x308-0x30b.7 (4)
0x0300| 47 4e 55 00| GNU.| name: "GNU" 0x30c-0x30f.7 (4)
0x0310|01 00 01 c0 04 00 00 00 01 00 00 00 00 00 00 00|................| desc: raw bits 0x310-0x32f.7 (32)
0x0320|02 00 01 c0 04 00 00 00 00 00 00 00 00 00 00 00|................|
| | | [8]{}: program_header 0x200-0x32f.7 (304)
0x0200|53 e5 74 64 |S.td | type: "os" (1685382483) (Operating system-specific) 0x200-0x203.7 (4)
| | | flags{}: 0x204-0x207.7 (4)

10
format/elf/testdata/linux_amd64/a_static.fqtest vendored
View File

@ -149,8 +149,14 @@ $ fq -d elf dv a_static
0x01e0| 30 00 00 00 00 00 00 00| 0.......| filesz: 48 0x1e8-0x1ef.7 (8)
0x01f0|30 00 00 00 00 00 00 00 |0....... | memsz: 48 0x1f0-0x1f7.7 (8)
0x01f0| 08 00 00 00 00 00 00 00| ........| align: 8 0x1f8-0x1ff.7 (8)
0x0300|04 00 00 00 20 00 00 00 05 00 00 00 47 4e 55 00|.... .......GNU.| data: raw bits 0x300-0x32f.7 (48)
* |until 0x32f.7 (48) | |
| | | notes[0:1]: 0x300-0x32f.7 (48)
| | | [0]{}: note 0x300-0x32f.7 (48)
0x0300|04 00 00 00 |.... | n_namesz: 4 0x300-0x303.7 (4)
0x0300| 20 00 00 00 | ... | n_descsz: 32 0x304-0x307.7 (4)
0x0300| 05 00 00 00 | .... | n_type: 0x5 0x308-0x30b.7 (4)
0x0300| 47 4e 55 00| GNU.| name: "GNU" 0x30c-0x30f.7 (4)
0x0310|01 00 01 c0 04 00 00 00 01 00 00 00 00 00 00 00|................| desc: raw bits 0x310-0x32f.7 (32)
0x0320|02 00 01 c0 04 00 00 00 00 00 00 00 00 00 00 00|................|
| | | [8]{}: program_header 0x200-0x32f.7 (304)
0x0200|53 e5 74 64 |S.td | type: "os" (1685382483) (Operating system-specific) 0x200-0x203.7 (4)
| | | flags{}: 0x204-0x207.7 (4)

10
format/elf/testdata/linux_amd64/a_stripped.fqtest vendored
View File

@ -151,8 +151,14 @@ $ fq -d elf dv a_stripped
0x01e0| 30 00 00 00 00 00 00 00| 0.......| filesz: 48 0x1e8-0x1ef.7 (8)
0x01f0|30 00 00 00 00 00 00 00 |0....... | memsz: 48 0x1f0-0x1f7.7 (8)
0x01f0| 08 00 00 00 00 00 00 00| ........| align: 8 0x1f8-0x1ff.7 (8)
0x0300|04 00 00 00 20 00 00 00 05 00 00 00 47 4e 55 00|.... .......GNU.| data: raw bits 0x300-0x32f.7 (48)
* |until 0x32f.7 (48) | |
| | | notes[0:1]: 0x300-0x32f.7 (48)
| | | [0]{}: note 0x300-0x32f.7 (48)
0x0300|04 00 00 00 |.... | n_namesz: 4 0x300-0x303.7 (4)
0x0300| 20 00 00 00 | ... | n_descsz: 32 0x304-0x307.7 (4)
0x0300| 05 00 00 00 | .... | n_type: 0x5 0x308-0x30b.7 (4)
0x0300| 47 4e 55 00| GNU.| name: "GNU" 0x30c-0x30f.7 (4)
0x0310|01 00 01 c0 04 00 00 00 01 00 00 00 00 00 00 00|................| desc: raw bits 0x310-0x32f.7 (32)
0x0320|02 00 01 c0 04 00 00 00 00 00 00 00 00 00 00 00|................|
| | | [8]{}: program_header 0x200-0x32f.7 (304)
0x0200|53 e5 74 64 |S.td | type: "os" (1685382483) (Operating system-specific) 0x200-0x203.7 (4)
| | | flags{}: 0x204-0x207.7 (4)

BIN
format/elf/testdata/linux_amd64/coredump vendored Normal file
View File

Binary file not shown.

376
format/elf/testdata/linux_amd64/coredump.fqtest vendored Normal file
View File

@ -0,0 +1,376 @@
$ fq -d elf dv coredump
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: coredump (elf) 0x0-0x31fff.7 (204800)
| | | header{}: 0x0-0x3f.7 (64)
| | | ident{}: 0x0-0xf.7 (16)
0x00000|7f 45 4c 46 |.ELF | magic: raw bits (valid) 0x0-0x3.7 (4)
0x00000| 02 | . | class: 64 (2) 0x4-0x4.7 (1)
0x00000| 01 | . | data: "little_endian" (1) 0x5-0x5.7 (1)
0x00000| 01 | . | version: 1 0x6-0x6.7 (1)
0x00000| 00 | . | os_abi: "sysv" (0) 0x7-0x7.7 (1)
0x00000| 00 | . | abi_version: 0 0x8-0x8.7 (1)
0x00000| 00 00 00 00 00 00 00| .......| pad: raw bits (all zero) 0x9-0xf.7 (7)
0x00010|04 00 |.. | type: "core" (0x4) 0x10-0x11.7 (2)
0x00010| 3e 00 | >. | machine: "x86_64" (0x3e) (AMD x86-64) 0x12-0x13.7 (2)
0x00010| 01 00 00 00 | .... | version: 1 0x14-0x17.7 (4)
0x00010| 00 00 00 00 00 00 00 00| ........| entry: 0 0x18-0x1f.7 (8)
0x00020|40 00 00 00 00 00 00 00 |@....... | phoff: 64 0x20-0x27.7 (8)
0x00020| 00 00 00 00 00 00 00 00| ........| shoff: 0 0x28-0x2f.7 (8)
0x00030|00 00 00 00 |.... | flags: 0 0x30-0x33.7 (4)
0x00030| 40 00 | @. | ehsize: 64 0x34-0x35.7 (2)
0x00030| 38 00 | 8. | phentsize: 56 0x36-0x37.7 (2)
0x00030| 12 00 | .. | phnum: 18 0x38-0x39.7 (2)
0x00030| 00 00 | .. | shentsize: 0 0x3a-0x3b.7 (2)
0x00030| 00 00 | .. | shnum: 0 0x3c-0x3d.7 (2)
0x00030| 00 00| ..| shstrndx: 0 0x3e-0x3f.7 (2)
| | | program_headers[0:18]: 0x40-0x31fff.7 (204736)
| | | [0]{}: program_header 0x40-0x1007.7 (4040)
0x00040|04 00 00 00 |.... | type: "note" (4) (Auxiliary information) 0x40-0x43.7 (4)
| | | flags{}: 0x44-0x47.7 (4)
0x00040| 00 | . | unused0: 0 0x44-0x44.4 (0.5)
0x00040| 00 | . | r: false 0x44.5-0x44.5 (0.1)
0x00040| 00 | . | w: false 0x44.6-0x44.6 (0.1)
0x00040| 00 | . | x: false 0x44.7-0x44.7 (0.1)
0x00040| 00 00 00 | ... | unused1: 0 0x45-0x47.7 (3)
0x00040| 30 04 00 00 00 00 00 00| 0.......| offset: 0x430 0x48-0x4f.7 (8)
0x00050|00 00 00 00 00 00 00 00 |........ | vaddr: 0x0 0x50-0x57.7 (8)
0x00050| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x58-0x5f.7 (8)
0x00060|d8 0b 00 00 00 00 00 00 |........ | filesz: 3032 0x60-0x67.7 (8)
0x00060| 00 00 00 00 00 00 00 00| ........| memsz: 0 0x68-0x6f.7 (8)
0x00070|00 00 00 00 00 00 00 00 |........ | align: 0 0x70-0x77.7 (8)
| | | notes[0:7]: 0x430-0x1007.7 (3032)
| | | [0]{}: note 0x430-0x593.7 (356)
0x00430|05 00 00 00 |.... | n_namesz: 5 0x430-0x433.7 (4)
0x00430| 50 01 00 00 | P... | n_descsz: 336 0x434-0x437.7 (4)
0x00430| 01 00 00 00 | .... | n_type: "prstatus" (0x1) 0x438-0x43b.7 (4)
0x00430| 43 4f 52 45| CORE| name: "CORE" 0x43c-0x440.7 (5)
0x00440|00 |. |
0x00440| 00 00 00 | ... | name_align: raw bits 0x441-0x443.7 (3)
0x00440| 0b 00 00 00 00 00 00 00 00 00 00 00| ............| desc: raw bits 0x444-0x593.7 (336)
0x00450|0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x593.7 (336) | |
| | | [1]{}: note 0x594-0x62f.7 (156)
0x00590| 05 00 00 00 | .... | n_namesz: 5 0x594-0x597.7 (4)
0x00590| 88 00 00 00 | .... | n_descsz: 136 0x598-0x59b.7 (4)
0x00590| 03 00 00 00| ....| n_type: "prpsinfo" (0x3) 0x59c-0x59f.7 (4)
0x005a0|43 4f 52 45 00 |CORE. | name: "CORE" 0x5a0-0x5a4.7 (5)
0x005a0| 00 00 00 | ... | name_align: raw bits 0x5a5-0x5a7.7 (3)
0x005a0| 00 52 00 00 00 00 00 00| .R......| desc: raw bits 0x5a8-0x62f.7 (136)
0x005b0|00 06 40 00 00 00 00 00 00 00 00 00 00 00 00 00|..@.............|
* |until 0x62f.7 (136) | |
| | | [2]{}: note 0x630-0x6c3.7 (148)
0x00630|05 00 00 00 |.... | n_namesz: 5 0x630-0x633.7 (4)
0x00630| 80 00 00 00 | .... | n_descsz: 128 0x634-0x637.7 (4)
0x00630| 49 47 49 53 | IGIS | n_type: "siginfo" (0x53494749) (Signal info) 0x638-0x63b.7 (4)
0x00630| 43 4f 52 45| CORE| name: "CORE" 0x63c-0x640.7 (5)
0x00640|00 |. |
0x00640| 00 00 00 | ... | name_align: raw bits 0x641-0x643.7 (3)
0x00640| 0b 00 00 00 00 00 00 00 01 00 00 00| ............| desc: raw bits 0x644-0x6c3.7 (128)
0x00650|00 00 00 00 44 33 22 11 00 00 00 00 00 00 00 00|....D3".........|
* |until 0x6c3.7 (128) | |
| | | [3]{}: note 0x6c4-0x817.7 (340)
0x006c0| 05 00 00 00 | .... | n_namesz: 5 0x6c4-0x6c7.7 (4)
0x006c0| 40 01 00 00 | @... | n_descsz: 320 0x6c8-0x6cb.7 (4)
0x006c0| 06 00 00 00| ....| n_type: "auxv" (0x6) 0x6cc-0x6cf.7 (4)
0x006d0|43 4f 52 45 00 |CORE. | name: "CORE" 0x6d0-0x6d4.7 (5)
0x006d0| 00 00 00 | ... | name_align: raw bits 0x6d5-0x6d7.7 (3)
0x006d0| 21 00 00 00 00 00 00 00| !.......| desc: raw bits 0x6d8-0x817.7 (320)
0x006e0|00 c0 87 9e fe 7f 00 00 10 00 00 00 00 00 00 00|................|
* |until 0x817.7 (320) | |
| | | [4]{}: note 0x818-0xa9f.7 (648)
0x00810| 05 00 00 00 | .... | n_namesz: 5 0x818-0x81b.7 (4)
0x00810| 72 02 00 00| r...| n_descsz: 626 0x81c-0x81f.7 (4)
0x00820|45 4c 49 46 |ELIF | n_type: "file" (0x46494c45) (File info) 0x820-0x823.7 (4)
0x00820| 43 4f 52 45 00 | CORE. | name: "CORE" 0x824-0x828.7 (5)
0x00820| 00 00 00 | ... | name_align: raw bits 0x829-0x82b.7 (3)
0x00820| 0a 00 00 00| ....| desc: raw bits 0x82c-0xa9d.7 (626)
0x00830|00 00 00 00 00 10 00 00 00 00 00 00 00 c0 63 e6|..............c.|
* |until 0xa9d.7 (626) | |
0x00a90| 00 00| ..| decs_align: raw bits 0xa9e-0xa9f.7 (2)
| | | [5]{}: note 0xaa0-0xcb3.7 (532)
0x00aa0|05 00 00 00 |.... | n_namesz: 5 0xaa0-0xaa3.7 (4)
0x00aa0| 00 02 00 00 | .... | n_descsz: 512 0xaa4-0xaa7.7 (4)
0x00aa0| 02 00 00 00 | .... | n_type: "prfpreg" (0x2) 0xaa8-0xaab.7 (4)
0x00aa0| 43 4f 52 45| CORE| name: "CORE" 0xaac-0xab0.7 (5)
0x00ab0|00 |. |
0x00ab0| 00 00 00 | ... | name_align: raw bits 0xab1-0xab3.7 (3)
0x00ab0| 7f 03 00 00 00 00 00 00 00 00 00 00| ............| desc: raw bits 0xab4-0xcb3.7 (512)
0x00ac0|00 00 00 00 00 00 00 00 00 00 00 00 80 1f 00 00|................|
* |until 0xcb3.7 (512) | |
| | | [6]{}: note 0xcb4-0x1007.7 (852)
0x00cb0| 06 00 00 00 | .... | n_namesz: 6 0xcb4-0xcb7.7 (4)
0x00cb0| 40 03 00 00 | @... | n_descsz: 832 0xcb8-0xcbb.7 (4)
0x00cb0| 02 02 00 00| ....| n_type: "x86_xstate" (0x202) (x86 extended state using xsave) 0xcbc-0xcbf.7 (4)
0x00cc0|4c 49 4e 55 58 00 |LINUX. | name: "LINUX" 0xcc0-0xcc5.7 (6)
0x00cc0| 00 00 | .. | name_align: raw bits 0xcc6-0xcc7.7 (2)
0x00cc0| 7f 03 00 00 00 00 00 00| ........| desc: raw bits 0xcc8-0x1007.7 (832)
0x00cd0|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x1007.7 (832) | |
| | | [1]{}: program_header 0x78-0x1fff.7 (8072)
0x00070| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x78-0x7b.7 (4)
| | | flags{}: 0x7c-0x7f.7 (4)
0x00070| 04 | . | unused0: 0 0x7c-0x7c.4 (0.5)
0x00070| 04 | . | r: true 0x7c.5-0x7c.5 (0.1)
0x00070| 04 | . | w: false 0x7c.6-0x7c.6 (0.1)
0x00070| 04 | . | x: false 0x7c.7-0x7c.7 (0.1)
0x00070| 00 00 00| ...| unused1: 0 0x7d-0x7f.7 (3)
0x00080|00 20 00 00 00 00 00 00 |. ...... | offset: 0x2000 0x80-0x87.7 (8)
0x00080| 00 c0 63 e6 e9 55 00 00| ..c..U..| vaddr: 0x55e9e663c000 0x88-0x8f.7 (8)
0x00090|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x90-0x97.7 (8)
0x00090| 00 00 00 00 00 00 00 00| ........| filesz: 0 0x98-0x9f.7 (8)
0x000a0|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0xa0-0xa7.7 (8)
0x000a0| 00 10 00 00 00 00 00 00| ........| align: 4096 0xa8-0xaf.7 (8)
| | | data: raw bits 0x2000-NA (0)
| | | [2]{}: program_header 0xb0-0x1fff.7 (8016)
0x000b0|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0xb0-0xb3.7 (4)
| | | flags{}: 0xb4-0xb7.7 (4)
0x000b0| 05 | . | unused0: 0 0xb4-0xb4.4 (0.5)
0x000b0| 05 | . | r: true 0xb4.5-0xb4.5 (0.1)
0x000b0| 05 | . | w: false 0xb4.6-0xb4.6 (0.1)
0x000b0| 05 | . | x: true 0xb4.7-0xb4.7 (0.1)
0x000b0| 00 00 00 | ... | unused1: 0 0xb5-0xb7.7 (3)
0x000b0| 00 20 00 00 00 00 00 00| . ......| offset: 0x2000 0xb8-0xbf.7 (8)
0x000c0|00 d0 63 e6 e9 55 00 00 |..c..U.. | vaddr: 0x55e9e663d000 0xc0-0xc7.7 (8)
0x000c0| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0xc8-0xcf.7 (8)
0x000d0|00 00 00 00 00 00 00 00 |........ | filesz: 0 0xd0-0xd7.7 (8)
0x000d0| 00 10 00 00 00 00 00 00| ........| memsz: 4096 0xd8-0xdf.7 (8)
0x000e0|00 10 00 00 00 00 00 00 |........ | align: 4096 0xe0-0xe7.7 (8)
| | | data: raw bits 0x2000-NA (0)
| | | [3]{}: program_header 0xe8-0x1fff.7 (7960)
0x000e0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0xe8-0xeb.7 (4)
| | | flags{}: 0xec-0xef.7 (4)
0x000e0| 04 | . | unused0: 0 0xec-0xec.4 (0.5)
0x000e0| 04 | . | r: true 0xec.5-0xec.5 (0.1)
0x000e0| 04 | . | w: false 0xec.6-0xec.6 (0.1)
0x000e0| 04 | . | x: false 0xec.7-0xec.7 (0.1)
0x000e0| 00 00 00| ...| unused1: 0 0xed-0xef.7 (3)
0x000f0|00 20 00 00 00 00 00 00 |. ...... | offset: 0x2000 0xf0-0xf7.7 (8)
0x000f0| 00 e0 63 e6 e9 55 00 00| ..c..U..| vaddr: 0x55e9e663e000 0xf8-0xff.7 (8)
0x00100|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x100-0x107.7 (8)
0x00100| 00 00 00 00 00 00 00 00| ........| filesz: 0 0x108-0x10f.7 (8)
0x00110|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x110-0x117.7 (8)
0x00110| 00 10 00 00 00 00 00 00| ........| align: 4096 0x118-0x11f.7 (8)
| | | data: raw bits 0x2000-NA (0)
| | | [4]{}: program_header 0x120-0x2fff.7 (12000)
0x00120|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x120-0x123.7 (4)
| | | flags{}: 0x124-0x127.7 (4)
0x00120| 04 | . | unused0: 0 0x124-0x124.4 (0.5)
0x00120| 04 | . | r: true 0x124.5-0x124.5 (0.1)
0x00120| 04 | . | w: false 0x124.6-0x124.6 (0.1)
0x00120| 04 | . | x: false 0x124.7-0x124.7 (0.1)
0x00120| 00 00 00 | ... | unused1: 0 0x125-0x127.7 (3)
0x00120| 00 20 00 00 00 00 00 00| . ......| offset: 0x2000 0x128-0x12f.7 (8)
0x00130|00 f0 63 e6 e9 55 00 00 |..c..U.. | vaddr: 0x55e9e663f000 0x130-0x137.7 (8)
0x00130| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x138-0x13f.7 (8)
0x00140|00 10 00 00 00 00 00 00 |........ | filesz: 4096 0x140-0x147.7 (8)
0x00140| 00 10 00 00 00 00 00 00| ........| memsz: 4096 0x148-0x14f.7 (8)
0x00150|00 10 00 00 00 00 00 00 |........ | align: 4096 0x150-0x157.7 (8)
0x02000|01 1b 03 3b 24 00 00 00 03 00 00 00 10 f0 ff ff|...;$...........| data: raw bits 0x2000-0x2fff.7 (4096)
* |until 0x2fff.7 (4096) | |
| | | [5]{}: program_header 0x158-0x3fff.7 (16040)
0x00150| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x158-0x15b.7 (4)
| | | flags{}: 0x15c-0x15f.7 (4)
0x00150| 06 | . | unused0: 0 0x15c-0x15c.4 (0.5)
0x00150| 06 | . | r: true 0x15c.5-0x15c.5 (0.1)
0x00150| 06 | . | w: true 0x15c.6-0x15c.6 (0.1)
0x00150| 06 | . | x: false 0x15c.7-0x15c.7 (0.1)
0x00150| 00 00 00| ...| unused1: 0 0x15d-0x15f.7 (3)
0x00160|00 30 00 00 00 00 00 00 |.0...... | offset: 0x3000 0x160-0x167.7 (8)
0x00160| 00 00 64 e6 e9 55 00 00| ..d..U..| vaddr: 0x55e9e6640000 0x168-0x16f.7 (8)
0x00170|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x170-0x177.7 (8)
0x00170| 00 10 00 00 00 00 00 00| ........| filesz: 4096 0x178-0x17f.7 (8)
0x00180|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x180-0x187.7 (8)
0x00180| 00 10 00 00 00 00 00 00| ........| align: 4096 0x188-0x18f.7 (8)
0x03000|00 00 64 e6 e9 55 00 00 00 00 00 00 00 00 00 00|..d..U..........| data: raw bits 0x3000-0x3fff.7 (4096)
* |until 0x3fff.7 (4096) | |
| | | [6]{}: program_header 0x190-0x3fff.7 (15984)
0x00190|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x190-0x193.7 (4)
| | | flags{}: 0x194-0x197.7 (4)
0x00190| 00 | . | unused0: 0 0x194-0x194.4 (0.5)
0x00190| 00 | . | r: false 0x194.5-0x194.5 (0.1)
0x00190| 00 | . | w: false 0x194.6-0x194.6 (0.1)
0x00190| 00 | . | x: false 0x194.7-0x194.7 (0.1)
0x00190| 00 00 00 | ... | unused1: 0 0x195-0x197.7 (3)
0x00190| 00 40 00 00 00 00 00 00| .@......| offset: 0x4000 0x198-0x19f.7 (8)
0x001a0|00 00 5f e7 e9 55 00 00 |.._..U.. | vaddr: 0x55e9e75f0000 0x1a0-0x1a7.7 (8)
0x001a0| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x1a8-0x1af.7 (8)
0x001b0|00 00 00 00 00 00 00 00 |........ | filesz: 0 0x1b0-0x1b7.7 (8)
0x001b0| 00 10 00 00 00 00 00 00| ........| memsz: 4096 0x1b8-0x1bf.7 (8)
0x001c0|00 10 00 00 00 00 00 00 |........ | align: 4096 0x1c0-0x1c7.7 (8)
| | | data: raw bits 0x4000-NA (0)
| | | [7]{}: program_header 0x1c8-0x4fff.7 (20024)
0x001c0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x1c8-0x1cb.7 (4)
| | | flags{}: 0x1cc-0x1cf.7 (4)
0x001c0| 06 | . | unused0: 0 0x1cc-0x1cc.4 (0.5)
0x001c0| 06 | . | r: true 0x1cc.5-0x1cc.5 (0.1)
0x001c0| 06 | . | w: true 0x1cc.6-0x1cc.6 (0.1)
0x001c0| 06 | . | x: false 0x1cc.7-0x1cc.7 (0.1)
0x001c0| 00 00 00| ...| unused1: 0 0x1cd-0x1cf.7 (3)
0x001d0|00 40 00 00 00 00 00 00 |.@...... | offset: 0x4000 0x1d0-0x1d7.7 (8)
0x001d0| 00 10 5f e7 e9 55 00 00| .._..U..| vaddr: 0x55e9e75f1000 0x1d8-0x1df.7 (8)
0x001e0|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x1e0-0x1e7.7 (8)
0x001e0| 00 10 00 00 00 00 00 00| ........| filesz: 4096 0x1e8-0x1ef.7 (8)
0x001f0|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x1f0-0x1f7.7 (8)
0x001f0| 00 10 00 00 00 00 00 00| ........| align: 4096 0x1f8-0x1ff.7 (8)
0x04000|e2 14 cb 78 67 54 a6 56 00 00 00 00 00 00 00 00|...xgT.V........| data: raw bits 0x4000-0x4fff.7 (4096)
* |until 0x4fff.7 (4096) | |
| | | [8]{}: program_header 0x200-0x4fff.7 (19968)
0x00200|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x200-0x203.7 (4)
| | | flags{}: 0x204-0x207.7 (4)
0x00200| 04 | . | unused0: 0 0x204-0x204.4 (0.5)
0x00200| 04 | . | r: true 0x204.5-0x204.5 (0.1)
0x00200| 04 | . | w: false 0x204.6-0x204.6 (0.1)
0x00200| 04 | . | x: false 0x204.7-0x204.7 (0.1)
0x00200| 00 00 00 | ... | unused1: 0 0x205-0x207.7 (3)
0x00200| 00 50 00 00 00 00 00 00| .P......| offset: 0x5000 0x208-0x20f.7 (8)
0x00210|00 10 25 0a 2e 7f 00 00 |..%..... | vaddr: 0x7f2e0a251000 0x210-0x217.7 (8)
0x00210| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x218-0x21f.7 (8)
0x00220|00 00 00 00 00 00 00 00 |........ | filesz: 0 0x220-0x227.7 (8)
0x00220| 00 50 01 00 00 00 00 00| .P......| memsz: 86016 0x228-0x22f.7 (8)
0x00230|00 10 00 00 00 00 00 00 |........ | align: 4096 0x230-0x237.7 (8)
| | | data: raw bits 0x5000-NA (0)
| | | [9]{}: program_header 0x238-0x4fff.7 (19912)
0x00230| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x238-0x23b.7 (4)
| | | flags{}: 0x23c-0x23f.7 (4)
0x00230| 05 | . | unused0: 0 0x23c-0x23c.4 (0.5)
0x00230| 05 | . | r: true 0x23c.5-0x23c.5 (0.1)
0x00230| 05 | . | w: false 0x23c.6-0x23c.6 (0.1)
0x00230| 05 | . | x: true 0x23c.7-0x23c.7 (0.1)
0x00230| 00 00 00| ...| unused1: 0 0x23d-0x23f.7 (3)
0x00240|00 50 00 00 00 00 00 00 |.P...... | offset: 0x5000 0x240-0x247.7 (8)
0x00240| 00 60 26 0a 2e 7f 00 00| .`&.....| vaddr: 0x7f2e0a266000 0x248-0x24f.7 (8)
0x00250|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x250-0x257.7 (8)
0x00250| 00 00 00 00 00 00 00 00| ........| filesz: 0 0x258-0x25f.7 (8)
0x00260|00 80 04 00 00 00 00 00 |........ | memsz: 294912 0x260-0x267.7 (8)
0x00260| 00 10 00 00 00 00 00 00| ........| align: 4096 0x268-0x26f.7 (8)
| | | data: raw bits 0x5000-NA (0)
| | | [10]{}: program_header 0x270-0x4fff.7 (19856)
0x00270|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x270-0x273.7 (4)
| | | flags{}: 0x274-0x277.7 (4)
0x00270| 04 | . | unused0: 0 0x274-0x274.4 (0.5)
0x00270| 04 | . | r: true 0x274.5-0x274.5 (0.1)
0x00270| 04 | . | w: false 0x274.6-0x274.6 (0.1)
0x00270| 04 | . | x: false 0x274.7-0x274.7 (0.1)
0x00270| 00 00 00 | ... | unused1: 0 0x275-0x277.7 (3)
0x00270| 00 50 00 00 00 00 00 00| .P......| offset: 0x5000 0x278-0x27f.7 (8)
0x00280|00 e0 2a 0a 2e 7f 00 00 |..*..... | vaddr: 0x7f2e0a2ae000 0x280-0x287.7 (8)
0x00280| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x288-0x28f.7 (8)
0x00290|00 00 00 00 00 00 00 00 |........ | filesz: 0 0x290-0x297.7 (8)
0x00290| 00 60 03 00 00 00 00 00| .`......| memsz: 221184 0x298-0x29f.7 (8)
0x002a0|00 10 00 00 00 00 00 00 |........ | align: 4096 0x2a0-0x2a7.7 (8)
| | | data: raw bits 0x5000-NA (0)
| | | [11]{}: program_header 0x2a8-0x5fff.7 (23896)
0x002a0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x2a8-0x2ab.7 (4)
| | | flags{}: 0x2ac-0x2af.7 (4)
0x002a0| 04 | . | unused0: 0 0x2ac-0x2ac.4 (0.5)
0x002a0| 04 | . | r: true 0x2ac.5-0x2ac.5 (0.1)
0x002a0| 04 | . | w: false 0x2ac.6-0x2ac.6 (0.1)
0x002a0| 04 | . | x: false 0x2ac.7-0x2ac.7 (0.1)
0x002a0| 00 00 00| ...| unused1: 0 0x2ad-0x2af.7 (3)
0x002b0|00 50 00 00 00 00 00 00 |.P...... | offset: 0x5000 0x2b0-0x2b7.7 (8)
0x002b0| 00 40 2e 0a 2e 7f 00 00| .@......| vaddr: 0x7f2e0a2e4000 0x2b8-0x2bf.7 (8)
0x002c0|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x2c0-0x2c7.7 (8)
0x002c0| 00 10 00 00 00 00 00 00| ........| filesz: 4096 0x2c8-0x2cf.7 (8)
0x002d0|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x2d0-0x2d7.7 (8)
0x002d0| 00 10 00 00 00 00 00 00| ........| align: 4096 0x2d8-0x2df.7 (8)
0x05000|66 2f 65 78 65 00 25 2e 2a 73 2f 65 74 63 2f 6c|f/exe.%.*s/etc/l| data: raw bits 0x5000-0x5fff.7 (4096)
* |until 0x5fff.7 (4096) | |
| | | [12]{}: program_header 0x2e0-0x6fff.7 (27936)
0x002e0|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x2e0-0x2e3.7 (4)
| | | flags{}: 0x2e4-0x2e7.7 (4)
0x002e0| 06 | . | unused0: 0 0x2e4-0x2e4.4 (0.5)
0x002e0| 06 | . | r: true 0x2e4.5-0x2e4.5 (0.1)
0x002e0| 06 | . | w: true 0x2e4.6-0x2e4.6 (0.1)
0x002e0| 06 | . | x: false 0x2e4.7-0x2e4.7 (0.1)
0x002e0| 00 00 00 | ... | unused1: 0 0x2e5-0x2e7.7 (3)
0x002e0| 00 60 00 00 00 00 00 00| .`......| offset: 0x6000 0x2e8-0x2ef.7 (8)
0x002f0|00 50 2e 0a 2e 7f 00 00 |.P...... | vaddr: 0x7f2e0a2e5000 0x2f0-0x2f7.7 (8)
0x002f0| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x2f8-0x2ff.7 (8)
0x00300|00 10 00 00 00 00 00 00 |........ | filesz: 4096 0x300-0x307.7 (8)
0x00300| 00 10 00 00 00 00 00 00| ........| memsz: 4096 0x308-0x30f.7 (8)
0x00310|00 10 00 00 00 00 00 00 |........ | align: 4096 0x310-0x317.7 (8)
0x06000|ca 28 2e 0a 2e 7f 00 00 d0 28 2e 0a 2e 7f 00 00|.(.......(......| data: raw bits 0x6000-0x6fff.7 (4096)
* |until 0x6fff.7 (4096) | |
| | | [13]{}: program_header 0x318-0x9fff.7 (40168)
0x00310| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x318-0x31b.7 (4)
| | | flags{}: 0x31c-0x31f.7 (4)
0x00310| 06 | . | unused0: 0 0x31c-0x31c.4 (0.5)
0x00310| 06 | . | r: true 0x31c.5-0x31c.5 (0.1)
0x00310| 06 | . | w: true 0x31c.6-0x31c.6 (0.1)
0x00310| 06 | . | x: false 0x31c.7-0x31c.7 (0.1)
0x00310| 00 00 00| ...| unused1: 0 0x31d-0x31f.7 (3)
0x00320|00 70 00 00 00 00 00 00 |.p...... | offset: 0x7000 0x320-0x327.7 (8)
0x00320| 00 60 2e 0a 2e 7f 00 00| .`......| vaddr: 0x7f2e0a2e6000 0x328-0x32f.7 (8)
0x00330|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x330-0x337.7 (8)
0x00330| 00 30 00 00 00 00 00 00| .0......| filesz: 12288 0x338-0x33f.7 (8)
0x00340|00 30 00 00 00 00 00 00 |.0...... | memsz: 12288 0x340-0x347.7 (8)
0x00340| 00 10 00 00 00 00 00 00| ........| align: 4096 0x348-0x34f.7 (8)
0x07000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0x7000-0x9fff.7 (12288)
* |until 0x9fff.7 (12288) | |
| | | [14]{}: program_header 0x350-0x2afff.7 (175280)
0x00350|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x350-0x353.7 (4)
| | | flags{}: 0x354-0x357.7 (4)
0x00350| 06 | . | unused0: 0 0x354-0x354.4 (0.5)
0x00350| 06 | . | r: true 0x354.5-0x354.5 (0.1)
0x00350| 06 | . | w: true 0x354.6-0x354.6 (0.1)
0x00350| 06 | . | x: false 0x354.7-0x354.7 (0.1)
0x00350| 00 00 00 | ... | unused1: 0 0x355-0x357.7 (3)
0x00350| 00 a0 00 00 00 00 00 00| ........| offset: 0xa000 0x358-0x35f.7 (8)
0x00360|00 20 7e 9e fe 7f 00 00 |. ~..... | vaddr: 0x7ffe9e7e2000 0x360-0x367.7 (8)
0x00360| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x368-0x36f.7 (8)
0x00370|00 10 02 00 00 00 00 00 |........ | filesz: 135168 0x370-0x377.7 (8)
0x00370| 00 10 02 00 00 00 00 00| ........| memsz: 135168 0x378-0x37f.7 (8)
0x00380|00 10 00 00 00 00 00 00 |........ | align: 4096 0x380-0x387.7 (8)
0x0a000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0xa000-0x2afff.7 (135168)
* |until 0x2afff.7 (135168) | |
| | | [15]{}: program_header 0x388-0x2efff.7 (191608)
0x00380| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x388-0x38b.7 (4)
| | | flags{}: 0x38c-0x38f.7 (4)
0x00380| 04 | . | unused0: 0 0x38c-0x38c.4 (0.5)
0x00380| 04 | . | r: true 0x38c.5-0x38c.5 (0.1)
0x00380| 04 | . | w: false 0x38c.6-0x38c.6 (0.1)
0x00380| 04 | . | x: false 0x38c.7-0x38c.7 (0.1)
0x00380| 00 00 00| ...| unused1: 0 0x38d-0x38f.7 (3)
0x00390|00 b0 02 00 00 00 00 00 |........ | offset: 0x2b000 0x390-0x397.7 (8)
0x00390| 00 80 87 9e fe 7f 00 00| ........| vaddr: 0x7ffe9e878000 0x398-0x39f.7 (8)
0x003a0|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x3a0-0x3a7.7 (8)
0x003a0| 00 40 00 00 00 00 00 00| .@......| filesz: 16384 0x3a8-0x3af.7 (8)
0x003b0|00 40 00 00 00 00 00 00 |.@...... | memsz: 16384 0x3b0-0x3b7.7 (8)
0x003b0| 00 10 00 00 00 00 00 00| ........| align: 4096 0x3b8-0x3bf.7 (8)
0x2b000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0x2b000-0x2efff.7 (16384)
* |until 0x2efff.7 (16384) | |
| | | [16]{}: program_header 0x3c0-0x30fff.7 (199744)
0x003c0|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x3c0-0x3c3.7 (4)
| | | flags{}: 0x3c4-0x3c7.7 (4)
0x003c0| 05 | . | unused0: 0 0x3c4-0x3c4.4 (0.5)
0x003c0| 05 | . | r: true 0x3c4.5-0x3c4.5 (0.1)
0x003c0| 05 | . | w: false 0x3c4.6-0x3c4.6 (0.1)
0x003c0| 05 | . | x: true 0x3c4.7-0x3c4.7 (0.1)
0x003c0| 00 00 00 | ... | unused1: 0 0x3c5-0x3c7.7 (3)
0x003c0| 00 f0 02 00 00 00 00 00| ........| offset: 0x2f000 0x3c8-0x3cf.7 (8)
0x003d0|00 c0 87 9e fe 7f 00 00 |........ | vaddr: 0x7ffe9e87c000 0x3d0-0x3d7.7 (8)
0x003d0| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x3d8-0x3df.7 (8)
0x003e0|00 20 00 00 00 00 00 00 |. ...... | filesz: 8192 0x3e0-0x3e7.7 (8)
0x003e0| 00 20 00 00 00 00 00 00| . ......| memsz: 8192 0x3e8-0x3ef.7 (8)
0x003f0|00 10 00 00 00 00 00 00 |........ | align: 4096 0x3f0-0x3f7.7 (8)
0x2f000|7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00|.ELF............| data: raw bits 0x2f000-0x30fff.7 (8192)
* |until 0x30fff.7 (8192) | |
| | | [17]{}: program_header 0x3f8-0x31fff.7 (203784)
0x003f0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x3f8-0x3fb.7 (4)
| | | flags{}: 0x3fc-0x3ff.7 (4)
0x003f0| 05 | . | unused0: 0 0x3fc-0x3fc.4 (0.5)
0x003f0| 05 | . | r: true 0x3fc.5-0x3fc.5 (0.1)
0x003f0| 05 | . | w: false 0x3fc.6-0x3fc.6 (0.1)
0x003f0| 05 | . | x: true 0x3fc.7-0x3fc.7 (0.1)
0x003f0| 00 00 00| ...| unused1: 0 0x3fd-0x3ff.7 (3)
0x00400|00 10 03 00 00 00 00 00 |........ | offset: 0x31000 0x400-0x407.7 (8)
0x00400| 00 00 60 ff ff ff ff ff| ..`.....| vaddr: 0xffffffffff600000 0x408-0x40f.7 (8)
0x00410|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x410-0x417.7 (8)
0x00410| 00 10 00 00 00 00 00 00| ........| filesz: 4096 0x418-0x41f.7 (8)
0x00420|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x420-0x427.7 (8)
0x00420| 00 10 00 00 00 00 00 00| ........| align: 4096 0x428-0x42f.7 (8)
0x31000|48 c7 c0 60 00 00 00 0f 05 c3 cc cc cc cc cc cc|H..`............| data: raw bits 0x31000-0x31fff.7 (4096)
* |until 0x31fff.7 (end) (4096) | |
| | | section_headers[0:0]: 0x430-NA (0)
0x01000| 00 00 00 00 00 00 00 00| ........| unknown0: raw bits 0x1008-0x1fff.7 (4088)
0x01010|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x1fff.7 (4088) | |

10
format/elf/testdata/linux_amd64/libbbb.so.fqtest vendored
View File

@ -119,8 +119,14 @@ $ fq -d elf dv libbbb.so
0x0170| 30 00 00 00 00 00 00 00| 0.......| filesz: 48 0x178-0x17f.7 (8)
0x0180|30 00 00 00 00 00 00 00 |0....... | memsz: 48 0x180-0x187.7 (8)
0x0180| 08 00 00 00 00 00 00 00| ........| align: 8 0x188-0x18f.7 (8)
0x20b0|04 00 00 00 20 00 00 00 05 00 00 00 47 4e 55 00|.... .......GNU.| data: raw bits 0x20b0-0x20df.7 (48)
* |until 0x20df.7 (48) | |
| | | notes[0:1]: 0x20b0-0x20df.7 (48)
| | | [0]{}: note 0x20b0-0x20df.7 (48)
0x20b0|04 00 00 00 |.... | n_namesz: 4 0x20b0-0x20b3.7 (4)
0x20b0| 20 00 00 00 | ... | n_descsz: 32 0x20b4-0x20b7.7 (4)
0x20b0| 05 00 00 00 | .... | n_type: 0x5 0x20b8-0x20bb.7 (4)
0x20b0| 47 4e 55 00| GNU.| name: "GNU" 0x20bc-0x20bf.7 (4)
0x20c0|01 00 01 c0 04 00 00 00 01 00 00 00 00 00 00 00|................| desc: raw bits 0x20c0-0x20df.7 (32)
0x20d0|02 00 01 c0 04 00 00 00 00 00 00 00 00 00 00 00|................|
| | | [6]{}: program_header 0x190-0x20df.7 (8016)
0x0190|53 e5 74 64 |S.td | type: "os" (1685382483) (Operating system-specific) 0x190-0x193.7 (4)
| | | flags{}: 0x194-0x197.7 (4)