wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-11-22 07:16:49 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #421 from wader/elf-notes

Browse Source 
elf: Basic program header notes decoding
This commit is contained in:
Mattias Wadman 2022-09-09 14:48:02 +02:00 committed by GitHub
commit e98adfaa03
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
14 changed files with 1029 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

223
format/elf/elf.go
View File

@ -4,6 +4,7 @@ package elf
// https://refspecs.linuxbase.org/elf/gabi4+/contents.html
// https://man7.org/linux/man-pages/man5/elf.5.html
// https://github.com/torvalds/linux/blob/master/include/uapi/linux/elf.h
// https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=include/elf/external.h;hb=HEAD
// TODO: dwarf
@ -63,12 +64,20 @@ var osABINames = scalar.UToSymStr{
255: "standalone",
}
const (
ET_NONE = 0
ET_REL = 1
ET_EXEC = 2
ET_DYN = 3
ET_CORE = 4
)
var typeNames = scalar.URangeToScalar{
{Range: [2]uint64{0x00, 0x00}, S: scalar.S{Sym: "none"}},
{Range: [2]uint64{0x01, 0x01}, S: scalar.S{Sym: "rel"}},
{Range: [2]uint64{0x02, 0x02}, S: scalar.S{Sym: "exec"}},
{Range: [2]uint64{0x03, 0x03}, S: scalar.S{Sym: "dyn"}},
{Range: [2]uint64{0x04, 0x04}, S: scalar.S{Sym: "core"}},
{Range: [2]uint64{ET_NONE, ET_NONE}, S: scalar.S{Sym: "none"}},
{Range: [2]uint64{ET_REL, ET_REL}, S: scalar.S{Sym: "rel"}},
{Range: [2]uint64{ET_EXEC, ET_EXEC}, S: scalar.S{Sym: "exec"}},
{Range: [2]uint64{ET_DYN, ET_DYN}, S: scalar.S{Sym: "dyn"}},
{Range: [2]uint64{ET_CORE, ET_CORE}, S: scalar.S{Sym: "core"}},
{Range: [2]uint64{0xfe00, 0xfeff}, S: scalar.S{Sym: "os"}},
{Range: [2]uint64{0xff00, 0xffff}, S: scalar.S{Sym: "proc"}},
}
@ -131,15 +140,26 @@ var machineNames = scalar.UToScalar{
0x101: {Sym: "wdc_65C816", Description: "WDC 65C816"},
}
const (
PT_NULL = 0
PT_LOAD = 1
PT_DYNAMIC = 2
PT_INTERP = 3
PT_NOTE = 4
PT_SHLIB = 5
PT_PHDR = 6
PT_TLS = 7
)
var phTypeNames = scalar.URangeToScalar{
{Range: [2]uint64{0x00000000, 0x00000000}, S: scalar.S{Sym: "null", Description: "Unused element"}},
{Range: [2]uint64{0x00000001, 0x00000001}, S: scalar.S{Sym: "load", Description: "Loadable segment"}},
{Range: [2]uint64{0x00000002, 0x00000002}, S: scalar.S{Sym: "dynamic", Description: "Dynamic linking information"}},
{Range: [2]uint64{0x00000003, 0x00000003}, S: scalar.S{Sym: "interp", Description: "Interpreter to invoke"}},
{Range: [2]uint64{0x00000004, 0x00000004}, S: scalar.S{Sym: "note", Description: "Auxiliary information"}},
{Range: [2]uint64{0x00000005, 0x00000005}, S: scalar.S{Sym: "shlib", Description: "Reserved but has unspecified"}},
{Range: [2]uint64{0x00000006, 0x00000006}, S: scalar.S{Sym: "phdr", Description: "Program header location and size"}},
{Range: [2]uint64{0x00000007, 0x00000007}, S: scalar.S{Sym: "tls", Description: "Thread-Local Storage template"}},
{Range: [2]uint64{PT_NULL, PT_NULL}, S: scalar.S{Sym: "null", Description: "Unused element"}},
{Range: [2]uint64{PT_LOAD, PT_LOAD}, S: scalar.S{Sym: "load", Description: "Loadable segment"}},
{Range: [2]uint64{PT_DYNAMIC, PT_DYNAMIC}, S: scalar.S{Sym: "dynamic", Description: "Dynamic linking information"}},
{Range: [2]uint64{PT_INTERP, PT_INTERP}, S: scalar.S{Sym: "interp", Description: "Interpreter to invoke"}},
{Range: [2]uint64{PT_NOTE, PT_NOTE}, S: scalar.S{Sym: "note", Description: "Auxiliary information"}},
{Range: [2]uint64{PT_SHLIB, PT_SHLIB}, S: scalar.S{Sym: "shlib", Description: "Reserved but has unspecified"}},
{Range: [2]uint64{PT_PHDR, PT_PHDR}, S: scalar.S{Sym: "phdr", Description: "Program header location and size"}},
{Range: [2]uint64{PT_TLS, PT_TLS}, S: scalar.S{Sym: "tls", Description: "Thread-Local Storage template"}},
{Range: [2]uint64{0x6474e550, 0x6474e550}, S: scalar.S{Sym: "gnu_eh_frame", Description: "GNU frame unwind information"}},
{Range: [2]uint64{0x6474e551, 0x6474e551}, S: scalar.S{Sym: "gnu_stack", Description: "GNU stack permission"}},
{Range: [2]uint64{0x6474e552, 0x6474e552}, S: scalar.S{Sym: "gnu_relro", Description: "GNU read-only after relocation"}},
@ -147,6 +167,143 @@ var phTypeNames = scalar.URangeToScalar{
{Range: [2]uint64{0x70000000, 0x7fffffff}, S: scalar.S{Sym: "proc", Description: "Processor-specific"}},
}
const (
NT_PRSTATUS = 1
NT_PRFPREG = 2
NT_PRPSINFO = 3
NT_TASKSTRUCT = 4
NT_AUXV = 6
NT_SIGINFO = 0x53494749 // "SIGI"
NT_FILE = 0x46494c45 // "FILE"
NT_PRXFPREG = 0x46e62b7f
NT_PPC_VMX = 0x100
NT_PPC_SPE = 0x101
NT_PPC_VSX = 0x102
NT_PPC_TAR = 0x103
NT_PPC_PPR = 0x104
NT_PPC_DSCR = 0x105
NT_PPC_EBB = 0x106
NT_PPC_PMU = 0x107
NT_PPC_TM_CGPR = 0x108
NT_PPC_TM_CFPR = 0x109
NT_PPC_TM_CVMX = 0x10a
NT_PPC_TM_CVSX = 0x10b
NT_PPC_TM_SPR = 0x10c
NT_PPC_TM_CTAR = 0x10d
NT_PPC_TM_CPPR = 0x10e
NT_PPC_TM_CDSCR = 0x10f
NT_PPC_PKEY = 0x110
NT_386_TLS = 0x200
NT_386_IOPERM = 0x201
NT_X86_XSTATE = 0x202
NT_S390_HIGH_GPRS = 0x300
NT_S390_TIMER = 0x301
NT_S390_TODCMP = 0x302
NT_S390_TODPREG = 0x303
NT_S390_CTRS = 0x304
NT_S390_PREFIX = 0x305
NT_S390_LAST_BREAK = 0x306
NT_S390_SYSTEM_CALL = 0x307
NT_S390_TDB = 0x308
NT_S390_VXRS_LOW = 0x309
NT_S390_VXRS_HIGH = 0x30a
NT_S390_GS_CB = 0x30b
NT_S390_GS_BC = 0x30c
NT_S390_RI_CB = 0x30d
NT_S390_PV_CPU_DATA = 0x30e
NT_ARM_VFP = 0x400
NT_ARM_TLS = 0x401
NT_ARM_HW_BREAK = 0x402
NT_ARM_HW_WATCH = 0x403
NT_ARM_SYSTEM_CALL = 0x404
NT_ARM_SVE = 0x405
NT_ARM_PAC_MASK = 0x406
NT_ARM_PACA_KEYS = 0x407
NT_ARM_PACG_KEYS = 0x408
NT_ARM_TAGGED_ADDR_CTRL = 0x409
NT_ARM_PAC_ENABLED_KEYS = 0x40a
NT_ARM_SSVE = 0x40b
NT_ARM_ZA = 0x40c
NT_ARC_V2 = 0x600
NT_VMCOREDD = 0x700
NT_MIPS_DSP = 0x800
NT_MIPS_FP_MODE = 0x801
NT_MIPS_MSA = 0x802
NT_LOONGARCH_CPUCFG = 0xa00
NT_LOONGARCH_CSR = 0xa01
NT_LOONGARCH_LSX = 0xa02
NT_LOONGARCH_LASX = 0xa03
NT_LOONGARCH_LBT = 0xa04
)
var coreNoteNames = scalar.UToScalar{
NT_PRSTATUS: {Sym: "prstatus"},
NT_PRFPREG: {Sym: "prfpreg"},
NT_PRPSINFO: {Sym: "prpsinfo"},
NT_TASKSTRUCT: {Sym: "taskstruct"},
NT_AUXV: {Sym: "auxv"},
NT_SIGINFO: {Sym: "siginfo", Description: "Signal info"},
NT_FILE: {Sym: "file", Description: "File info"},
NT_PRXFPREG: {Sym: "prxfpreg"},
NT_PPC_SPE: {Sym: "ppc_spe", Description: "PowerPC SPE/EVR registers"},
NT_PPC_VSX: {Sym: "ppc_vsx", Description: "PowerPC VSX registers"},
NT_PPC_TAR: {Sym: "ppc_tar", Description: "Target Address Register"},
NT_PPC_PPR: {Sym: "ppc_ppr", Description: "Program Priority Register"},
NT_PPC_DSCR: {Sym: "ppc_dscr", Description: "Data Stream Control Register"},
NT_PPC_EBB: {Sym: "ppc_ebb", Description: "Event Based Branch Registers"},
NT_PPC_PMU: {Sym: "ppc_pmu", Description: "Performance Monitor Registers"},
NT_PPC_TM_CGPR: {Sym: "ppc_tm_cgpr", Description: "TM checkpointed GPR Registers"},
NT_PPC_TM_CFPR: {Sym: "ppc_tm_cfpr", Description: "TM checkpointed FPR Registers"},
NT_PPC_TM_CVMX: {Sym: "ppc_tm_cvmx", Description: "TM checkpointed VMX Registers"},
NT_PPC_TM_CVSX: {Sym: "ppc_tm_cvsx", Description: "TM checkpointed VSX Registers"},
NT_PPC_TM_SPR: {Sym: "ppc_tm_spr", Description: "TM Special Purpose Registers"},
NT_PPC_TM_CTAR: {Sym: "ppc_tm_ctar", Description: "TM checkpointed Target Address Register"},
NT_PPC_TM_CPPR: {Sym: "ppc_tm_cppr", Description: "TM checkpointed Program Priority Register"},
NT_PPC_TM_CDSCR: {Sym: "ppc_tm_cdscr", Description: "TM checkpointed Data Stream Control Register"},
NT_PPC_PKEY: {Sym: "ppc_pkey", Description: "Memory Protection Keys registers"},
NT_386_TLS: {Sym: "386_tls", Description: "i386 TLS slots (struct user_desc)"},
NT_386_IOPERM: {Sym: "386_ioperm", Description: "x86 io permission bitmap (1=deny)"},
NT_X86_XSTATE: {Sym: "x86_xstate", Description: "x86 extended state using xsave"},
NT_S390_HIGH_GPRS: {Sym: "s390_high_gprs", Description: "s390 upper register halves"},
NT_S390_TIMER: {Sym: "s390_timer", Description: "s390 timer register"},
NT_S390_TODCMP: {Sym: "s390_todcmp", Description: "s390 TOD clock comparator register"},
NT_S390_TODPREG: {Sym: "s390_todpreg", Description: "s390 TOD programmable register"},
NT_S390_CTRS: {Sym: "s390_ctrs", Description: "s390 control registers"},
NT_S390_PREFIX: {Sym: "s390_prefix", Description: "s390 prefix register"},
NT_S390_LAST_BREAK: {Sym: "s390_last_break", Description: "s390 breaking event address"},
NT_S390_SYSTEM_CALL: {Sym: "s390_system_call", Description: "s390 system call restart data"},
NT_S390_TDB: {Sym: "s390_tdb", Description: "s390 transaction diagnostic block"},
NT_S390_VXRS_LOW: {Sym: "s390_vxrs_low", Description: "s390 vector registers 0-15 upper half"},
NT_S390_VXRS_HIGH: {Sym: "s390_vxrs_high", Description: "s390 vector registers 16-31"},
NT_S390_GS_CB: {Sym: "s390_gs_cb", Description: "s390 guarded storage registers"},
NT_S390_GS_BC: {Sym: "s390_gs_bc", Description: "s390 guarded storage broadcast control block"},
NT_S390_RI_CB: {Sym: "s390_ri_cb", Description: "s390 runtime instrumentation"},
NT_S390_PV_CPU_DATA: {Sym: "s390_pv_cpu_data", Description: "s390 protvirt cpu dump data"},
NT_ARM_VFP: {Sym: "arm_vfp", Description: "ARM VFP/NEON registers"},
NT_ARM_TLS: {Sym: "arm_tls", Description: "ARM TLS register"},
NT_ARM_HW_BREAK: {Sym: "arm_hw_break", Description: "ARM hardware breakpoint registers"},
NT_ARM_HW_WATCH: {Sym: "arm_hw_watch", Description: "ARM hardware watchpoint registers"},
NT_ARM_SYSTEM_CALL: {Sym: "arm_system_call", Description: "ARM system call number"},
NT_ARM_SVE: {Sym: "arm_sve", Description: "ARM Scalable Vector Extension registers"},
NT_ARM_PAC_MASK: {Sym: "arm_pac_mask", Description: "ARM pointer authentication code masks"},
NT_ARM_PACA_KEYS: {Sym: "arm_paca_keys", Description: "ARM pointer authentication address keys"},
NT_ARM_PACG_KEYS: {Sym: "arm_pacg_keys", Description: "ARM pointer authentication generic key"},
NT_ARM_TAGGED_ADDR_CTRL: {Sym: "arm_tagged_addr_ctrl", Description: "arm64 tagged address control (prctl())"},
NT_ARM_PAC_ENABLED_KEYS: {Sym: "arm_pac_enabled_keys", Description: "arm64 ptr auth enabled keys (prctl())"},
NT_ARM_SSVE: {Sym: "arm_ssve", Description: "ARM Streaming SVE registers"},
NT_ARM_ZA: {Sym: "arm_za", Description: "ARM SME ZA registers"},
NT_ARC_V2: {Sym: "arc_v2", Description: "ARCv2 accumulator/extra registers"},
NT_VMCOREDD: {Sym: "vmcoredd", Description: "Vmcore Device Dump Note"},
NT_MIPS_DSP: {Sym: "mips_dsp", Description: "MIPS DSP ASE registers"},
NT_MIPS_FP_MODE: {Sym: "mips_fp_mode", Description: "MIPS floating-point mode"},
NT_MIPS_MSA: {Sym: "mips_msa", Description: "MIPS SIMD registers"},
NT_LOONGARCH_CPUCFG: {Sym: "loongarch_cpucfg", Description: "LoongArch CPU config registers"},
NT_LOONGARCH_CSR: {Sym: "loongarch_csr", Description: "LoongArch control and status registers"},
NT_LOONGARCH_LSX: {Sym: "loongarch_lsx", Description: "LoongArch Loongson SIMD Extension registers"},
NT_LOONGARCH_LASX: {Sym: "loongarch_lasx", Description: "LoongArch Loongson Advanced SIMD Extension registers"},
NT_LOONGARCH_LBT: {Sym: "loongarch_lbt", Description: "LoongArch Loongson Binary Translation registers"},
}
const (
SHT_NULL = 0x0
SHT_PROGBITS = 0x1
@ -602,6 +759,7 @@ func elfReadSectionHeaders(d *decode.D, ec *elfContext) {
type elfContext struct {
archBits int
typ int
machine int
endian decode.Endian
@ -661,7 +819,7 @@ func elfDecodeHeader(d *decode.D, ec *elfContext) {
d.Fatalf("unknown endian %d", endian)
}
d.FieldU16("type", typeNames, scalar.ActualHex)
typ := d.FieldU16("type", typeNames, scalar.ActualHex)
machine := d.FieldU16("machine", machineNames, scalar.ActualHex)
d.FieldU32("version")
d.FieldU("entry", archBits)
@ -677,6 +835,7 @@ func elfDecodeHeader(d *decode.D, ec *elfContext) {
ec.archBits = archBits
ec.endian = d.Endian
ec.typ = int(typ)
ec.machine = int(machine)
ec.phOff = int64(phOff) * 8
ec.phNum = int(phNum)
@ -705,12 +864,13 @@ func elfDecodeProgramHeader(d *decode.D, ec elfContext) {
})
}
var typ uint64
var offset uint64
var size uint64
switch ec.archBits {
case 32:
d.FieldU32("type", phTypeNames)
typ = d.FieldU32("type", phTypeNames)
offset = d.FieldU("offset", ec.archBits, scalar.ActualHex)
d.FieldU("vaddr", ec.archBits, scalar.ActualHex)
d.FieldU("paddr", ec.archBits, scalar.ActualHex)
@ -719,7 +879,7 @@ func elfDecodeProgramHeader(d *decode.D, ec elfContext) {
pFlags(d)
d.FieldU32("align")
case 64:
d.FieldU32("type", phTypeNames)
typ = d.FieldU32("type", phTypeNames)
pFlags(d)
offset = d.FieldU("offset", ec.archBits, scalar.ActualHex)
d.FieldU("vaddr", ec.archBits, scalar.ActualHex)
@ -730,7 +890,36 @@ func elfDecodeProgramHeader(d *decode.D, ec elfContext) {
}
d.RangeFn(int64(offset*8), int64(size*8), func(d *decode.D) {
d.FieldRawLen("data", d.BitsLeft())
switch {
case typ == PT_NOTE:
d.FieldArray("notes", func(d *decode.D) {
for !d.End() {
d.FieldStruct("note", func(d *decode.D) {
// elf manpage says this is 32 or 64 bit but it seems it is always 32
// and that is also what readelf external.h says
nameSz := d.FieldU32("n_namesz")
descSz := d.FieldU32("n_descsz")
if ec.typ == ET_CORE {
d.FieldU32("n_type", coreNoteNames, scalar.ActualHex)
} else {
d.FieldU32("n_type", scalar.ActualHex)
}
d.FieldUTF8NullFixedLen("name", int(nameSz))
nameAlign := d.AlignBits(4 * 8)
if nameAlign != 0 {
d.FieldRawLen("name_align", int64(nameAlign))
}
d.FieldRawLen("desc", int64(descSz)*8)
descAlign := d.AlignBits(4 * 8)
if descAlign != 0 {
d.FieldRawLen("decs_align", int64(descAlign))
}
})
}
})
default:
d.FieldRawLen("data", d.BitsLeft())
}
})
}

12
format/elf/testdata/Makefile vendored
View File

@ -1,4 +1,4 @@
TARGETS=libbbb.o libbbb.so libbbb.a a.o a_dynamic a_stripped a_static
TARGETS=libbbb.o libbbb.so libbbb.a a.o a_dynamic a_stripped a_static coredump
all: $(TARGETS)
@ -13,7 +13,7 @@ clean:
rm -f $(TARGETS)
build:
docker run -ti --rm --platform $(PLATFORM) -v "$(PWD):$(PWD)" -w "$(PWD)" alpine:3.15.0 sh -c 'apk add build-base && make'
docker run -ti --rm --platform $(PLATFORM) -v "$(PWD):$(PWD)" -w "$(PWD)" alpine:3.15.0 sh -c 'apk add build-base && ulimit -c unlimited && make'
mkdir -p $(DIR)
mv $(TARGETS) $(DIR)
rm $(DIR)/*.o
@ -23,9 +23,17 @@ libbbb.so: libbbb.o
libbbb.a: libbbb.o
ar ru $@ $+
ranlib $@
a_dynamic: a.o
$(CC) -o $@ $+ -L./ -lbbb
a_stripped: a_dynamic
strip -o $@ $<
a_static: a.o libbbb.a
$(CC) -o $@ $+ libbbb.a
segfault: segfault.o
$(CC) -o $@ $<
coredump: segfault
./segfault ; mv core coredump ; rm -f segfault segfault.o ; exit 0

12
format/elf/testdata/linux_386/a_dynamic.fqtest vendored
View File

@ -150,9 +150,15 @@ $ fq -d elf dv a_dynamic
0x0120| 04 | . | x: false 0x12c.7-0x12c.7 (0.1)
0x0120| 00 00 00| ...| unused1: 0 0x12d-0x12f.7 (3)
0x0130|04 00 00 00 |.... | align: 4 0x130-0x133.7 (4)
0x01c0| 04 00 00 00| ....| data: raw bits 0x1cc-0x1f3.7 (40)
0x01d0|18 00 00 00 05 00 00 00 47 4e 55 00 01 00 01 c0|........GNU.....|
* |until 0x1f3.7 (40) | |
| | | notes[0:1]: 0x1cc-0x1f3.7 (40)
| | | [0]{}: note 0x1cc-0x1f3.7 (40)
0x01c0| 04 00 00 00| ....| n_namesz: 4 0x1cc-0x1cf.7 (4)
0x01d0|18 00 00 00 |.... | n_descsz: 24 0x1d0-0x1d3.7 (4)
0x01d0| 05 00 00 00 | .... | n_type: 0x5 0x1d4-0x1d7.7 (4)
0x01d0| 47 4e 55 00 | GNU. | name: "GNU" 0x1d8-0x1db.7 (4)
0x01d0| 01 00 01 c0| ....| desc: raw bits 0x1dc-0x1f3.7 (24)
0x01e0|04 00 00 00 01 00 00 00 02 00 01 c0 04 00 00 00|................|
0x01f0|00 00 00 00 |.... |
| | | [8]{}: program_header 0x134-0x1f3.7 (192)
0x0130| 53 e5 74 64 | S.td | type: "os" (1685382483) (Operating system-specific) 0x134-0x137.7 (4)
0x0130| cc 01 00 00 | .... | offset: 0x1cc 0x138-0x13b.7 (4)

12
format/elf/testdata/linux_386/a_static.fqtest vendored
View File

@ -152,9 +152,15 @@ $ fq -d elf dv a_static
0x0120| 04 | . | x: false 0x12c.7-0x12c.7 (0.1)
0x0120| 00 00 00| ...| unused1: 0 0x12d-0x12f.7 (3)
0x0130|04 00 00 00 |.... | align: 4 0x130-0x133.7 (4)
0x01c0| 04 00 00 00| ....| data: raw bits 0x1cc-0x1f3.7 (40)
0x01d0|18 00 00 00 05 00 00 00 47 4e 55 00 01 00 01 c0|........GNU.....|
* |until 0x1f3.7 (40) | |
| | | notes[0:1]: 0x1cc-0x1f3.7 (40)
| | | [0]{}: note 0x1cc-0x1f3.7 (40)
0x01c0| 04 00 00 00| ....| n_namesz: 4 0x1cc-0x1cf.7 (4)
0x01d0|18 00 00 00 |.... | n_descsz: 24 0x1d0-0x1d3.7 (4)
0x01d0| 05 00 00 00 | .... | n_type: 0x5 0x1d4-0x1d7.7 (4)
0x01d0| 47 4e 55 00 | GNU. | name: "GNU" 0x1d8-0x1db.7 (4)
0x01d0| 01 00 01 c0| ....| desc: raw bits 0x1dc-0x1f3.7 (24)
0x01e0|04 00 00 00 01 00 00 00 02 00 01 c0 04 00 00 00|................|
0x01f0|00 00 00 00 |.... |
| | | [8]{}: program_header 0x134-0x1f3.7 (192)
0x0130| 53 e5 74 64 | S.td | type: "os" (1685382483) (Operating system-specific) 0x134-0x137.7 (4)
0x0130| cc 01 00 00 | .... | offset: 0x1cc 0x138-0x13b.7 (4)

12
format/elf/testdata/linux_386/a_stripped.fqtest vendored
View File

@ -150,9 +150,15 @@ $ fq -d elf dv a_stripped
0x0120| 04 | . | x: false 0x12c.7-0x12c.7 (0.1)
0x0120| 00 00 00| ...| unused1: 0 0x12d-0x12f.7 (3)
0x0130|04 00 00 00 |.... | align: 4 0x130-0x133.7 (4)
0x01c0| 04 00 00 00| ....| data: raw bits 0x1cc-0x1f3.7 (40)
0x01d0|18 00 00 00 05 00 00 00 47 4e 55 00 01 00 01 c0|........GNU.....|
* |until 0x1f3.7 (40) | |
| | | notes[0:1]: 0x1cc-0x1f3.7 (40)
| | | [0]{}: note 0x1cc-0x1f3.7 (40)
0x01c0| 04 00 00 00| ....| n_namesz: 4 0x1cc-0x1cf.7 (4)
0x01d0|18 00 00 00 |.... | n_descsz: 24 0x1d0-0x1d3.7 (4)
0x01d0| 05 00 00 00 | .... | n_type: 0x5 0x1d4-0x1d7.7 (4)
0x01d0| 47 4e 55 00 | GNU. | name: "GNU" 0x1d8-0x1db.7 (4)
0x01d0| 01 00 01 c0| ....| desc: raw bits 0x1dc-0x1f3.7 (24)
0x01e0|04 00 00 00 01 00 00 00 02 00 01 c0 04 00 00 00|................|
0x01f0|00 00 00 00 |.... |
| | | [8]{}: program_header 0x134-0x1f3.7 (192)
0x0130| 53 e5 74 64 | S.td | type: "os" (1685382483) (Operating system-specific) 0x134-0x137.7 (4)
0x0130| cc 01 00 00 | .... | offset: 0x1cc 0x138-0x13b.7 (4)

BIN
format/elf/testdata/linux_386/coredump vendored Normal file
View File

Binary file not shown.

371
format/elf/testdata/linux_386/coredump.fqtest vendored Normal file
View File

@ -0,0 +1,371 @@
$ fq -d elf dv coredump
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: coredump (elf) 0x0-0x2efff.7 (192512)
| | | header{}: 0x0-0x33.7 (52)
| | | ident{}: 0x0-0xf.7 (16)
0x00000|7f 45 4c 46 |.ELF | magic: raw bits (valid) 0x0-0x3.7 (4)
0x00000| 01 | . | class: 32 (1) 0x4-0x4.7 (1)
0x00000| 01 | . | data: "little_endian" (1) 0x5-0x5.7 (1)
0x00000| 01 | . | version: 1 0x6-0x6.7 (1)
0x00000| 00 | . | os_abi: "sysv" (0) 0x7-0x7.7 (1)
0x00000| 00 | . | abi_version: 0 0x8-0x8.7 (1)
0x00000| 00 00 00 00 00 00 00| .......| pad: raw bits (all zero) 0x9-0xf.7 (7)
0x00010|04 00 |.. | type: "core" (0x4) 0x10-0x11.7 (2)
0x00010| 03 00 | .. | machine: "x86" (0x3) (x86) 0x12-0x13.7 (2)
0x00010| 01 00 00 00 | .... | version: 1 0x14-0x17.7 (4)
0x00010| 00 00 00 00 | .... | entry: 0 0x18-0x1b.7 (4)
0x00010| 34 00 00 00| 4...| phoff: 52 0x1c-0x1f.7 (4)
0x00020|00 00 00 00 |.... | shoff: 0 0x20-0x23.7 (4)
0x00020| 00 00 00 00 | .... | flags: 0 0x24-0x27.7 (4)
0x00020| 34 00 | 4. | ehsize: 52 0x28-0x29.7 (2)
0x00020| 20 00 | . | phentsize: 32 0x2a-0x2b.7 (2)
0x00020| 11 00 | .. | phnum: 17 0x2c-0x2d.7 (2)
0x00020| 00 00| ..| shentsize: 0 0x2e-0x2f.7 (2)
0x00030|00 00 |.. | shnum: 0 0x30-0x31.7 (2)
0x00030| 00 00 | .. | shstrndx: 0 0x32-0x33.7 (2)
| | | program_headers[0:17]: 0x34-0x2efff.7 (192460)
| | | [0]{}: program_header 0x34-0xcff.7 (3276)
0x00030| 04 00 00 00 | .... | type: "note" (4) (Auxiliary information) 0x34-0x37.7 (4)
0x00030| 54 02 00 00 | T... | offset: 0x254 0x38-0x3b.7 (4)
0x00030| 00 00 00 00| ....| vaddr: 0x0 0x3c-0x3f.7 (4)
0x00040|00 00 00 00 |.... | paddr: 0x0 0x40-0x43.7 (4)
0x00040| ac 0a 00 00 | .... | filesz: 2732 0x44-0x47.7 (4)
0x00040| 00 00 00 00 | .... | memsz: 0 0x48-0x4b.7 (4)
| | | flags{}: 0x4c-0x4f.7 (4)
0x00040| 00 | . | unused0: 0 0x4c-0x4c.4 (0.5)
0x00040| 00 | . | r: false 0x4c.5-0x4c.5 (0.1)
0x00040| 00 | . | w: false 0x4c.6-0x4c.6 (0.1)
0x00040| 00 | . | x: false 0x4c.7-0x4c.7 (0.1)
0x00040| 00 00 00| ...| unused1: 0 0x4d-0x4f.7 (3)
0x00050|00 00 00 00 |.... | align: 0 0x50-0x53.7 (4)
| | | notes[0:9]: 0x254-0xcff.7 (2732)
| | | [0]{}: note 0x254-0x2f7.7 (164)
0x00250| 05 00 00 00 | .... | n_namesz: 5 0x254-0x257.7 (4)
0x00250| 90 00 00 00 | .... | n_descsz: 144 0x258-0x25b.7 (4)
0x00250| 01 00 00 00| ....| n_type: "prstatus" (0x1) 0x25c-0x25f.7 (4)
0x00260|43 4f 52 45 00 |CORE. | name: "CORE" 0x260-0x264.7 (5)
0x00260| 00 00 00 | ... | name_align: raw bits 0x265-0x267.7 (3)
0x00260| 0b 00 00 00 00 00 00 00| ........| desc: raw bits 0x268-0x2f7.7 (144)
0x00270|00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x2f7.7 (144) | |
| | | [1]{}: note 0x2f8-0x387.7 (144)
0x002f0| 05 00 00 00 | .... | n_namesz: 5 0x2f8-0x2fb.7 (4)
0x002f0| 7c 00 00 00| |...| n_descsz: 124 0x2fc-0x2ff.7 (4)
0x00300|03 00 00 00 |.... | n_type: "prpsinfo" (0x3) 0x300-0x303.7 (4)
0x00300| 43 4f 52 45 00 | CORE. | name: "CORE" 0x304-0x308.7 (5)
0x00300| 00 00 00 | ... | name_align: raw bits 0x309-0x30b.7 (3)
0x00300| 00 52 00 00| .R..| desc: raw bits 0x30c-0x387.7 (124)
0x00310|00 06 40 00 00 00 00 00 24 00 00 00 23 00 00 00|..@.....$...#...|
* |until 0x387.7 (124) | |
| | | [2]{}: note 0x388-0x41b.7 (148)
0x00380| 05 00 00 00 | .... | n_namesz: 5 0x388-0x38b.7 (4)
0x00380| 80 00 00 00| ....| n_descsz: 128 0x38c-0x38f.7 (4)
0x00390|49 47 49 53 |IGIS | n_type: "siginfo" (0x53494749) (Signal info) 0x390-0x393.7 (4)
0x00390| 43 4f 52 45 00 | CORE. | name: "CORE" 0x394-0x398.7 (5)
0x00390| 00 00 00 | ... | name_align: raw bits 0x399-0x39b.7 (3)
0x00390| 0b 00 00 00| ....| desc: raw bits 0x39c-0x41b.7 (128)
0x003a0|00 00 00 00 01 00 00 00 44 33 22 11 00 00 00 00|........D3".....|
* |until 0x41b.7 (128) | |
| | | [3]{}: note 0x41c-0x4d7.7 (188)
0x00410| 05 00 00 00| ....| n_namesz: 5 0x41c-0x41f.7 (4)
0x00420|a8 00 00 00 |.... | n_descsz: 168 0x420-0x423.7 (4)
0x00420| 06 00 00 00 | .... | n_type: "auxv" (0x6) 0x424-0x427.7 (4)
0x00420| 43 4f 52 45 00 | CORE. | name: "CORE" 0x428-0x42c.7 (5)
0x00420| 00 00 00| ...| name_align: raw bits 0x42d-0x42f.7 (3)
0x00430|20 00 00 00 40 e5 f5 f7 21 00 00 00 00 e0 f5 f7| ...@...!.......| desc: raw bits 0x430-0x4d7.7 (168)
* |until 0x4d7.7 (168) | |
| | | [4]{}: note 0x4d8-0x6d3.7 (508)
0x004d0| 05 00 00 00 | .... | n_namesz: 5 0x4d8-0x4db.7 (4)
0x004d0| e8 01 00 00| ....| n_descsz: 488 0x4dc-0x4df.7 (4)
0x004e0|45 4c 49 46 |ELIF | n_type: "file" (0x46494c45) (File info) 0x4e0-0x4e3.7 (4)
0x004e0| 43 4f 52 45 00 | CORE. | name: "CORE" 0x4e4-0x4e8.7 (5)
0x004e0| 00 00 00 | ... | name_align: raw bits 0x4e9-0x4eb.7 (3)
0x004e0| 0a 00 00 00| ....| desc: raw bits 0x4ec-0x6d3.7 (488)
0x004f0|00 10 00 00 00 80 59 56 00 90 59 56 00 00 00 00|......YV..YV....|
* |until 0x6d3.7 (488) | |
| | | [5]{}: note 0x6d4-0x753.7 (128)
0x006d0| 05 00 00 00 | .... | n_namesz: 5 0x6d4-0x6d7.7 (4)
0x006d0| 6c 00 00 00 | l... | n_descsz: 108 0x6d8-0x6db.7 (4)
0x006d0| 02 00 00 00| ....| n_type: "prfpreg" (0x2) 0x6dc-0x6df.7 (4)
0x006e0|43 4f 52 45 00 |CORE. | name: "CORE" 0x6e0-0x6e4.7 (5)
0x006e0| 00 00 00 | ... | name_align: raw bits 0x6e5-0x6e7.7 (3)
0x006e0| 7f 03 ff ff 00 00 ff ff| ........| desc: raw bits 0x6e8-0x753.7 (108)
0x006f0|ff ff ff ff 00 00 00 00 23 00 00 00 00 00 00 00|........#.......|
* |until 0x753.7 (108) | |
| | | [6]{}: note 0x754-0x967.7 (532)
0x00750| 06 00 00 00 | .... | n_namesz: 6 0x754-0x757.7 (4)
0x00750| 00 02 00 00 | .... | n_descsz: 512 0x758-0x75b.7 (4)
0x00750| 7f 2b e6 46| .+.F| n_type: "prxfpreg" (0x46e62b7f) 0x75c-0x75f.7 (4)
0x00760|4c 49 4e 55 58 00 |LINUX. | name: "LINUX" 0x760-0x765.7 (6)
0x00760| 00 00 | .. | name_align: raw bits 0x766-0x767.7 (2)
0x00760| 7f 03 00 00 00 00 00 00| ........| desc: raw bits 0x768-0x967.7 (512)
0x00770|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x967.7 (512) | |
| | | [7]{}: note 0x968-0xcbb.7 (852)
0x00960| 06 00 00 00 | .... | n_namesz: 6 0x968-0x96b.7 (4)
0x00960| 40 03 00 00| @...| n_descsz: 832 0x96c-0x96f.7 (4)
0x00970|02 02 00 00 |.... | n_type: "x86_xstate" (0x202) (x86 extended state using xsave) 0x970-0x973.7 (4)
0x00970| 4c 49 4e 55 58 00 | LINUX. | name: "LINUX" 0x974-0x979.7 (6)
0x00970| 00 00 | .. | name_align: raw bits 0x97a-0x97b.7 (2)
0x00970| 7f 03 00 00| ....| desc: raw bits 0x97c-0xcbb.7 (832)
0x00980|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0xcbb.7 (832) | |
| | | [8]{}: note 0xcbc-0xcff.7 (68)
0x00cb0| 06 00 00 00| ....| n_namesz: 6 0xcbc-0xcbf.7 (4)
0x00cc0|30 00 00 00 |0... | n_descsz: 48 0xcc0-0xcc3.7 (4)
0x00cc0| 00 02 00 00 | .... | n_type: "386_tls" (0x200) (i386 TLS slots (struct user_desc)) 0xcc4-0xcc7.7 (4)
0x00cc0| 4c 49 4e 55 58 00 | LINUX. | name: "LINUX" 0xcc8-0xccd.7 (6)
0x00cc0| 00 00| ..| name_align: raw bits 0xcce-0xccf.7 (2)
0x00cd0|0c 00 00 00 84 7c ff f7 ff ff 0f 00 51 00 00 00|.....|......Q...| desc: raw bits 0xcd0-0xcff.7 (48)
* |until 0xcff.7 (48) | |
| | | [1]{}: program_header 0x54-0xfff.7 (4012)
0x00050| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x54-0x57.7 (4)
0x00050| 00 10 00 00 | .... | offset: 0x1000 0x58-0x5b.7 (4)
0x00050| 00 80 59 56| ..YV| vaddr: 0x56598000 0x5c-0x5f.7 (4)
0x00060|00 00 00 00 |.... | paddr: 0x0 0x60-0x63.7 (4)
0x00060| 00 00 00 00 | .... | filesz: 0 0x64-0x67.7 (4)
0x00060| 00 10 00 00 | .... | memsz: 4096 0x68-0x6b.7 (4)
| | | flags{}: 0x6c-0x6f.7 (4)
0x00060| 04 | . | unused0: 0 0x6c-0x6c.4 (0.5)
0x00060| 04 | . | r: true 0x6c.5-0x6c.5 (0.1)
0x00060| 04 | . | w: false 0x6c.6-0x6c.6 (0.1)
0x00060| 04 | . | x: false 0x6c.7-0x6c.7 (0.1)
0x00060| 00 00 00| ...| unused1: 0 0x6d-0x6f.7 (3)
0x00070|00 10 00 00 |.... | align: 4096 0x70-0x73.7 (4)
| | | data: raw bits 0x1000-NA (0)
| | | [2]{}: program_header 0x74-0xfff.7 (3980)
0x00070| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x74-0x77.7 (4)
0x00070| 00 10 00 00 | .... | offset: 0x1000 0x78-0x7b.7 (4)
0x00070| 00 90 59 56| ..YV| vaddr: 0x56599000 0x7c-0x7f.7 (4)
0x00080|00 00 00 00 |.... | paddr: 0x0 0x80-0x83.7 (4)
0x00080| 00 00 00 00 | .... | filesz: 0 0x84-0x87.7 (4)
0x00080| 00 10 00 00 | .... | memsz: 4096 0x88-0x8b.7 (4)
| | | flags{}: 0x8c-0x8f.7 (4)
0x00080| 05 | . | unused0: 0 0x8c-0x8c.4 (0.5)
0x00080| 05 | . | r: true 0x8c.5-0x8c.5 (0.1)
0x00080| 05 | . | w: false 0x8c.6-0x8c.6 (0.1)
0x00080| 05 | . | x: true 0x8c.7-0x8c.7 (0.1)
0x00080| 00 00 00| ...| unused1: 0 0x8d-0x8f.7 (3)
0x00090|00 10 00 00 |.... | align: 4096 0x90-0x93.7 (4)
| | | data: raw bits 0x1000-NA (0)
| | | [3]{}: program_header 0x94-0xfff.7 (3948)
0x00090| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x94-0x97.7 (4)
0x00090| 00 10 00 00 | .... | offset: 0x1000 0x98-0x9b.7 (4)
0x00090| 00 a0 59 56| ..YV| vaddr: 0x5659a000 0x9c-0x9f.7 (4)
0x000a0|00 00 00 00 |.... | paddr: 0x0 0xa0-0xa3.7 (4)
0x000a0| 00 00 00 00 | .... | filesz: 0 0xa4-0xa7.7 (4)
0x000a0| 00 10 00 00 | .... | memsz: 4096 0xa8-0xab.7 (4)
| | | flags{}: 0xac-0xaf.7 (4)
0x000a0| 04 | . | unused0: 0 0xac-0xac.4 (0.5)
0x000a0| 04 | . | r: true 0xac.5-0xac.5 (0.1)
0x000a0| 04 | . | w: false 0xac.6-0xac.6 (0.1)
0x000a0| 04 | . | x: false 0xac.7-0xac.7 (0.1)
0x000a0| 00 00 00| ...| unused1: 0 0xad-0xaf.7 (3)
0x000b0|00 10 00 00 |.... | align: 4096 0xb0-0xb3.7 (4)
| | | data: raw bits 0x1000-NA (0)
| | | [4]{}: program_header 0xb4-0x1fff.7 (8012)
0x000b0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0xb4-0xb7.7 (4)
0x000b0| 00 10 00 00 | .... | offset: 0x1000 0xb8-0xbb.7 (4)
0x000b0| 00 b0 59 56| ..YV| vaddr: 0x5659b000 0xbc-0xbf.7 (4)
0x000c0|00 00 00 00 |.... | paddr: 0x0 0xc0-0xc3.7 (4)
0x000c0| 00 10 00 00 | .... | filesz: 4096 0xc4-0xc7.7 (4)
0x000c0| 00 10 00 00 | .... | memsz: 4096 0xc8-0xcb.7 (4)
| | | flags{}: 0xcc-0xcf.7 (4)
0x000c0| 04 | . | unused0: 0 0xcc-0xcc.4 (0.5)
0x000c0| 04 | . | r: true 0xcc.5-0xcc.5 (0.1)
0x000c0| 04 | . | w: false 0xcc.6-0xcc.6 (0.1)
0x000c0| 04 | . | x: false 0xcc.7-0xcc.7 (0.1)
0x000c0| 00 00 00| ...| unused1: 0 0xcd-0xcf.7 (3)
0x000d0|00 10 00 00 |.... | align: 4096 0xd0-0xd3.7 (4)
0x01000|01 1b 03 3b 28 00 00 00 04 00 00 00 20 f0 ff ff|...;(....... ...| data: raw bits 0x1000-0x1fff.7 (4096)
* |until 0x1fff.7 (4096) | |
| | | [5]{}: program_header 0xd4-0x2fff.7 (12076)
0x000d0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0xd4-0xd7.7 (4)
0x000d0| 00 20 00 00 | . .. | offset: 0x2000 0xd8-0xdb.7 (4)
0x000d0| 00 c0 59 56| ..YV| vaddr: 0x5659c000 0xdc-0xdf.7 (4)
0x000e0|00 00 00 00 |.... | paddr: 0x0 0xe0-0xe3.7 (4)
0x000e0| 00 10 00 00 | .... | filesz: 4096 0xe4-0xe7.7 (4)
0x000e0| 00 10 00 00 | .... | memsz: 4096 0xe8-0xeb.7 (4)
| | | flags{}: 0xec-0xef.7 (4)
0x000e0| 06 | . | unused0: 0 0xec-0xec.4 (0.5)
0x000e0| 06 | . | r: true 0xec.5-0xec.5 (0.1)
0x000e0| 06 | . | w: true 0xec.6-0xec.6 (0.1)
0x000e0| 06 | . | x: false 0xec.7-0xec.7 (0.1)
0x000e0| 00 00 00| ...| unused1: 0 0xed-0xef.7 (3)
0x000f0|00 10 00 00 |.... | align: 4096 0xf0-0xf3.7 (4)
0x02000|00 c0 59 56 00 00 00 00 00 00 00 00 00 00 00 00|..YV............| data: raw bits 0x2000-0x2fff.7 (4096)
* |until 0x2fff.7 (4096) | |
| | | [6]{}: program_header 0xf4-0x2fff.7 (12044)
0x000f0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0xf4-0xf7.7 (4)
0x000f0| 00 30 00 00 | .0.. | offset: 0x3000 0xf8-0xfb.7 (4)
0x000f0| 00 90 95 56| ...V| vaddr: 0x56959000 0xfc-0xff.7 (4)
0x00100|00 00 00 00 |.... | paddr: 0x0 0x100-0x103.7 (4)
0x00100| 00 00 00 00 | .... | filesz: 0 0x104-0x107.7 (4)
0x00100| 00 10 00 00 | .... | memsz: 4096 0x108-0x10b.7 (4)
| | | flags{}: 0x10c-0x10f.7 (4)
0x00100| 00 | . | unused0: 0 0x10c-0x10c.4 (0.5)
0x00100| 00 | . | r: false 0x10c.5-0x10c.5 (0.1)
0x00100| 00 | . | w: false 0x10c.6-0x10c.6 (0.1)
0x00100| 00 | . | x: false 0x10c.7-0x10c.7 (0.1)
0x00100| 00 00 00| ...| unused1: 0 0x10d-0x10f.7 (3)
0x00110|00 10 00 00 |.... | align: 4096 0x110-0x113.7 (4)
| | | data: raw bits 0x3000-NA (0)
| | | [7]{}: program_header 0x114-0x3fff.7 (16108)
0x00110| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x114-0x117.7 (4)
0x00110| 00 30 00 00 | .0.. | offset: 0x3000 0x118-0x11b.7 (4)
0x00110| 00 a0 95 56| ...V| vaddr: 0x5695a000 0x11c-0x11f.7 (4)
0x00120|00 00 00 00 |.... | paddr: 0x0 0x120-0x123.7 (4)
0x00120| 00 10 00 00 | .... | filesz: 4096 0x124-0x127.7 (4)
0x00120| 00 10 00 00 | .... | memsz: 4096 0x128-0x12b.7 (4)
| | | flags{}: 0x12c-0x12f.7 (4)
0x00120| 06 | . | unused0: 0 0x12c-0x12c.4 (0.5)
0x00120| 06 | . | r: true 0x12c.5-0x12c.5 (0.1)
0x00120| 06 | . | w: true 0x12c.6-0x12c.6 (0.1)
0x00120| 06 | . | x: false 0x12c.7-0x12c.7 (0.1)
0x00120| 00 00 00| ...| unused1: 0 0x12d-0x12f.7 (3)
0x00130|00 10 00 00 |.... | align: 4096 0x130-0x133.7 (4)
0x03000|e9 ed 4d 0e fe 91 f9 68 00 00 00 00 aa 00 00 00|..M....h........| data: raw bits 0x3000-0x3fff.7 (4096)
* |until 0x3fff.7 (4096) | |
| | | [8]{}: program_header 0x134-0x7fff.7 (32460)
0x00130| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x134-0x137.7 (4)
0x00130| 00 40 00 00 | .@.. | offset: 0x4000 0x138-0x13b.7 (4)
0x00130| 00 a0 f5 f7| ....| vaddr: 0xf7f5a000 0x13c-0x13f.7 (4)
0x00140|00 00 00 00 |.... | paddr: 0x0 0x140-0x143.7 (4)
0x00140| 00 40 00 00 | .@.. | filesz: 16384 0x144-0x147.7 (4)
0x00140| 00 40 00 00 | .@.. | memsz: 16384 0x148-0x14b.7 (4)
| | | flags{}: 0x14c-0x14f.7 (4)
0x00140| 04 | . | unused0: 0 0x14c-0x14c.4 (0.5)
0x00140| 04 | . | r: true 0x14c.5-0x14c.5 (0.1)
0x00140| 04 | . | w: false 0x14c.6-0x14c.6 (0.1)
0x00140| 04 | . | x: false 0x14c.7-0x14c.7 (0.1)
0x00140| 00 00 00| ...| unused1: 0 0x14d-0x14f.7 (3)
0x00150|00 10 00 00 |.... | align: 4096 0x150-0x153.7 (4)
0x04000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0x4000-0x7fff.7 (16384)
* |until 0x7fff.7 (16384) | |
| | | [9]{}: program_header 0x154-0x9fff.7 (40620)
0x00150| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x154-0x157.7 (4)
0x00150| 00 80 00 00 | .... | offset: 0x8000 0x158-0x15b.7 (4)
0x00150| 00 e0 f5 f7| ....| vaddr: 0xf7f5e000 0x15c-0x15f.7 (4)
0x00160|00 00 00 00 |.... | paddr: 0x0 0x160-0x163.7 (4)
0x00160| 00 20 00 00 | . .. | filesz: 8192 0x164-0x167.7 (4)
0x00160| 00 20 00 00 | . .. | memsz: 8192 0x168-0x16b.7 (4)
| | | flags{}: 0x16c-0x16f.7 (4)
0x00160| 05 | . | unused0: 0 0x16c-0x16c.4 (0.5)
0x00160| 05 | . | r: true 0x16c.5-0x16c.5 (0.1)
0x00160| 05 | . | w: false 0x16c.6-0x16c.6 (0.1)
0x00160| 05 | . | x: true 0x16c.7-0x16c.7 (0.1)
0x00160| 00 00 00| ...| unused1: 0 0x16d-0x16f.7 (3)
0x00170|00 10 00 00 |.... | align: 4096 0x170-0x173.7 (4)
0x08000|7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00|.ELF............| data: raw bits 0x8000-0x9fff.7 (8192)
* |until 0x9fff.7 (8192) | |
| | | [10]{}: program_header 0x174-0x9fff.7 (40588)
0x00170| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x174-0x177.7 (4)
0x00170| 00 a0 00 00 | .... | offset: 0xa000 0x178-0x17b.7 (4)
0x00170| 00 00 f6 f7| ....| vaddr: 0xf7f60000 0x17c-0x17f.7 (4)
0x00180|00 00 00 00 |.... | paddr: 0x0 0x180-0x183.7 (4)
0x00180| 00 00 00 00 | .... | filesz: 0 0x184-0x187.7 (4)
0x00180| 00 20 01 00 | . .. | memsz: 73728 0x188-0x18b.7 (4)
| | | flags{}: 0x18c-0x18f.7 (4)
0x00180| 04 | . | unused0: 0 0x18c-0x18c.4 (0.5)
0x00180| 04 | . | r: true 0x18c.5-0x18c.5 (0.1)
0x00180| 04 | . | w: false 0x18c.6-0x18c.6 (0.1)
0x00180| 04 | . | x: false 0x18c.7-0x18c.7 (0.1)
0x00180| 00 00 00| ...| unused1: 0 0x18d-0x18f.7 (3)
0x00190|00 10 00 00 |.... | align: 4096 0x190-0x193.7 (4)
| | | data: raw bits 0xa000-NA (0)
| | | [11]{}: program_header 0x194-0x9fff.7 (40556)
0x00190| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x194-0x197.7 (4)
0x00190| 00 a0 00 00 | .... | offset: 0xa000 0x198-0x19b.7 (4)
0x00190| 00 20 f7 f7| . ..| vaddr: 0xf7f72000 0x19c-0x19f.7 (4)
0x001a0|00 00 00 00 |.... | paddr: 0x0 0x1a0-0x1a3.7 (4)
0x001a0| 00 00 00 00 | .... | filesz: 0 0x1a4-0x1a7.7 (4)
0x001a0| 00 f0 04 00 | .... | memsz: 323584 0x1a8-0x1ab.7 (4)
| | | flags{}: 0x1ac-0x1af.7 (4)
0x001a0| 05 | . | unused0: 0 0x1ac-0x1ac.4 (0.5)
0x001a0| 05 | . | r: true 0x1ac.5-0x1ac.5 (0.1)
0x001a0| 05 | . | w: false 0x1ac.6-0x1ac.6 (0.1)
0x001a0| 05 | . | x: true 0x1ac.7-0x1ac.7 (0.1)
0x001a0| 00 00 00| ...| unused1: 0 0x1ad-0x1af.7 (3)
0x001b0|00 10 00 00 |.... | align: 4096 0x1b0-0x1b3.7 (4)
| | | data: raw bits 0xa000-NA (0)
| | | [12]{}: program_header 0x1b4-0x9fff.7 (40524)
0x001b0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x1b4-0x1b7.7 (4)
0x001b0| 00 a0 00 00 | .... | offset: 0xa000 0x1b8-0x1bb.7 (4)
0x001b0| 00 10 fc f7| ....| vaddr: 0xf7fc1000 0x1bc-0x1bf.7 (4)
0x001c0|00 00 00 00 |.... | paddr: 0x0 0x1c0-0x1c3.7 (4)
0x001c0| 00 00 00 00 | .... | filesz: 0 0x1c4-0x1c7.7 (4)
0x001c0| 00 40 03 00 | .@.. | memsz: 212992 0x1c8-0x1cb.7 (4)
| | | flags{}: 0x1cc-0x1cf.7 (4)
0x001c0| 04 | . | unused0: 0 0x1cc-0x1cc.4 (0.5)
0x001c0| 04 | . | r: true 0x1cc.5-0x1cc.5 (0.1)
0x001c0| 04 | . | w: false 0x1cc.6-0x1cc.6 (0.1)
0x001c0| 04 | . | x: false 0x1cc.7-0x1cc.7 (0.1)
0x001c0| 00 00 00| ...| unused1: 0 0x1cd-0x1cf.7 (3)
0x001d0|00 10 00 00 |.... | align: 4096 0x1d0-0x1d3.7 (4)
| | | data: raw bits 0xa000-NA (0)
| | | [13]{}: program_header 0x1d4-0xafff.7 (44588)
0x001d0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x1d4-0x1d7.7 (4)
0x001d0| 00 a0 00 00 | .... | offset: 0xa000 0x1d8-0x1db.7 (4)
0x001d0| 00 50 ff f7| .P..| vaddr: 0xf7ff5000 0x1dc-0x1df.7 (4)
0x001e0|00 00 00 00 |.... | paddr: 0x0 0x1e0-0x1e3.7 (4)
0x001e0| 00 10 00 00 | .... | filesz: 4096 0x1e4-0x1e7.7 (4)
0x001e0| 00 10 00 00 | .... | memsz: 4096 0x1e8-0x1eb.7 (4)
| | | flags{}: 0x1ec-0x1ef.7 (4)
0x001e0| 04 | . | unused0: 0 0x1ec-0x1ec.4 (0.5)
0x001e0| 04 | . | r: true 0x1ec.5-0x1ec.5 (0.1)
0x001e0| 04 | . | w: false 0x1ec.6-0x1ec.6 (0.1)
0x001e0| 04 | . | x: false 0x1ec.7-0x1ec.7 (0.1)
0x001e0| 00 00 00| ...| unused1: 0 0x1ed-0x1ef.7 (3)
0x001f0|00 10 00 00 |.... | align: 4096 0x1f0-0x1f3.7 (4)
0x0a000|87 02 41 0e 0c 86 03 41 0e 10 83 04 4e 0e 4c 03|..A....A....N.L.| data: raw bits 0xa000-0xafff.7 (4096)
* |until 0xafff.7 (4096) | |
| | | [14]{}: program_header 0x1f4-0xbfff.7 (48652)
0x001f0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x1f4-0x1f7.7 (4)
0x001f0| 00 b0 00 00 | .... | offset: 0xb000 0x1f8-0x1fb.7 (4)
0x001f0| 00 60 ff f7| .`..| vaddr: 0xf7ff6000 0x1fc-0x1ff.7 (4)
0x00200|00 00 00 00 |.... | paddr: 0x0 0x200-0x203.7 (4)
0x00200| 00 10 00 00 | .... | filesz: 4096 0x204-0x207.7 (4)
0x00200| 00 10 00 00 | .... | memsz: 4096 0x208-0x20b.7 (4)
| | | flags{}: 0x20c-0x20f.7 (4)
0x00200| 06 | . | unused0: 0 0x20c-0x20c.4 (0.5)
0x00200| 06 | . | r: true 0x20c.5-0x20c.5 (0.1)
0x00200| 06 | . | w: true 0x20c.6-0x20c.6 (0.1)
0x00200| 06 | . | x: false 0x20c.7-0x20c.7 (0.1)
0x00200| 00 00 00| ...| unused1: 0 0x20d-0x20f.7 (3)
0x00210|00 10 00 00 |.... | align: 4096 0x210-0x213.7 (4)
0x0b000|00 00 00 00 2d f4 51 58 cf 8c b1 c0 46 f6 b5 cb|....-.QX....F...| data: raw bits 0xb000-0xbfff.7 (4096)
* |until 0xbfff.7 (4096) | |
| | | [15]{}: program_header 0x214-0xdfff.7 (56812)
0x00210| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x214-0x217.7 (4)
0x00210| 00 c0 00 00 | .... | offset: 0xc000 0x218-0x21b.7 (4)
0x00210| 00 70 ff f7| .p..| vaddr: 0xf7ff7000 0x21c-0x21f.7 (4)
0x00220|00 00 00 00 |.... | paddr: 0x0 0x220-0x223.7 (4)
0x00220| 00 20 00 00 | . .. | filesz: 8192 0x224-0x227.7 (4)
0x00220| 00 20 00 00 | . .. | memsz: 8192 0x228-0x22b.7 (4)
| | | flags{}: 0x22c-0x22f.7 (4)
0x00220| 06 | . | unused0: 0 0x22c-0x22c.4 (0.5)
0x00220| 06 | . | r: true 0x22c.5-0x22c.5 (0.1)
0x00220| 06 | . | w: true 0x22c.6-0x22c.6 (0.1)
0x00220| 06 | . | x: false 0x22c.7-0x22c.7 (0.1)
0x00220| 00 00 00| ...| unused1: 0 0x22d-0x22f.7 (3)
0x00230|00 10 00 00 |.... | align: 4096 0x230-0x233.7 (4)
0x0c000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0xc000-0xdfff.7 (8192)
* |until 0xdfff.7 (8192) | |
| | | [16]{}: program_header 0x234-0x2efff.7 (191948)
0x00230| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x234-0x237.7 (4)
0x00230| 00 e0 00 00 | .... | offset: 0xe000 0x238-0x23b.7 (4)
0x00230| 00 b0 d5 ff| ....| vaddr: 0xffd5b000 0x23c-0x23f.7 (4)
0x00240|00 00 00 00 |.... | paddr: 0x0 0x240-0x243.7 (4)
0x00240| 00 10 02 00 | .... | filesz: 135168 0x244-0x247.7 (4)
0x00240| 00 10 02 00 | .... | memsz: 135168 0x248-0x24b.7 (4)
| | | flags{}: 0x24c-0x24f.7 (4)
0x00240| 06 | . | unused0: 0 0x24c-0x24c.4 (0.5)
0x00240| 06 | . | r: true 0x24c.5-0x24c.5 (0.1)
0x00240| 06 | . | w: true 0x24c.6-0x24c.6 (0.1)
0x00240| 06 | . | x: false 0x24c.7-0x24c.7 (0.1)
0x00240| 00 00 00| ...| unused1: 0 0x24d-0x24f.7 (3)
0x00250|00 10 00 00 |.... | align: 4096 0x250-0x253.7 (4)
0x0e000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0xe000-0x2efff.7 (135168)
* |until 0x2efff.7 (end) (135168) | |
| | | section_headers[0:0]: 0x254-NA (0)
0x00d00|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| unknown0: raw bits 0xd00-0xfff.7 (768)
* |until 0xfff.7 (768) | |

9
format/elf/testdata/linux_386/libbbb.so.fqtest vendored
View File

@ -119,8 +119,13 @@ $ fq -d elf dv libbbb.so
0x00e0| 04 | . | x: false 0xec.7-0xec.7 (0.1)
0x00e0| 00 00 00| ...| unused1: 0 0xed-0xef.7 (3)
0x00f0|04 00 00 00 |.... | align: 4 0xf0-0xf3.7 (4)
0x20c0| 04 00 00 00 18 00 00 00 05 00 00 00| ............| data: raw bits 0x20c4-0x20eb.7 (40)
0x20d0|47 4e 55 00 01 00 01 c0 04 00 00 00 01 00 00 00|GNU.............|
| | | notes[0:1]: 0x20c4-0x20eb.7 (40)
| | | [0]{}: note 0x20c4-0x20eb.7 (40)
0x20c0| 04 00 00 00 | .... | n_namesz: 4 0x20c4-0x20c7.7 (4)
0x20c0| 18 00 00 00 | .... | n_descsz: 24 0x20c8-0x20cb.7 (4)
0x20c0| 05 00 00 00| ....| n_type: 0x5 0x20cc-0x20cf.7 (4)
0x20d0|47 4e 55 00 |GNU. | name: "GNU" 0x20d0-0x20d3.7 (4)
0x20d0| 01 00 01 c0 04 00 00 00 01 00 00 00| ............| desc: raw bits 0x20d4-0x20eb.7 (24)
0x20e0|02 00 01 c0 04 00 00 00 00 00 00 00 |............ |
| | | [6]{}: program_header 0xf4-0x20eb.7 (8184)
0x00f0| 53 e5 74 64 | S.td | type: "os" (1685382483) (Operating system-specific) 0xf4-0xf7.7 (4)

10
format/elf/testdata/linux_amd64/a_dynamic.fqtest vendored
View File

@ -151,8 +151,14 @@ $ fq -d elf dv a_dynamic
0x01e0| 30 00 00 00 00 00 00 00| 0.......| filesz: 48 0x1e8-0x1ef.7 (8)
0x01f0|30 00 00 00 00 00 00 00 |0....... | memsz: 48 0x1f0-0x1f7.7 (8)
0x01f0| 08 00 00 00 00 00 00 00| ........| align: 8 0x1f8-0x1ff.7 (8)
0x0300|04 00 00 00 20 00 00 00 05 00 00 00 47 4e 55 00|.... .......GNU.| data: raw bits 0x300-0x32f.7 (48)
* |until 0x32f.7 (48) | |
| | | notes[0:1]: 0x300-0x32f.7 (48)
| | | [0]{}: note 0x300-0x32f.7 (48)
0x0300|04 00 00 00 |.... | n_namesz: 4 0x300-0x303.7 (4)
0x0300| 20 00 00 00 | ... | n_descsz: 32 0x304-0x307.7 (4)
0x0300| 05 00 00 00 | .... | n_type: 0x5 0x308-0x30b.7 (4)
0x0300| 47 4e 55 00| GNU.| name: "GNU" 0x30c-0x30f.7 (4)
0x0310|01 00 01 c0 04 00 00 00 01 00 00 00 00 00 00 00|................| desc: raw bits 0x310-0x32f.7 (32)
0x0320|02 00 01 c0 04 00 00 00 00 00 00 00 00 00 00 00|................|
| | | [8]{}: program_header 0x200-0x32f.7 (304)
0x0200|53 e5 74 64 |S.td | type: "os" (1685382483) (Operating system-specific) 0x200-0x203.7 (4)
| | | flags{}: 0x204-0x207.7 (4)

10
format/elf/testdata/linux_amd64/a_static.fqtest vendored
View File

@ -149,8 +149,14 @@ $ fq -d elf dv a_static
0x01e0| 30 00 00 00 00 00 00 00| 0.......| filesz: 48 0x1e8-0x1ef.7 (8)
0x01f0|30 00 00 00 00 00 00 00 |0....... | memsz: 48 0x1f0-0x1f7.7 (8)
0x01f0| 08 00 00 00 00 00 00 00| ........| align: 8 0x1f8-0x1ff.7 (8)
0x0300|04 00 00 00 20 00 00 00 05 00 00 00 47 4e 55 00|.... .......GNU.| data: raw bits 0x300-0x32f.7 (48)
* |until 0x32f.7 (48) | |
| | | notes[0:1]: 0x300-0x32f.7 (48)
| | | [0]{}: note 0x300-0x32f.7 (48)
0x0300|04 00 00 00 |.... | n_namesz: 4 0x300-0x303.7 (4)
0x0300| 20 00 00 00 | ... | n_descsz: 32 0x304-0x307.7 (4)
0x0300| 05 00 00 00 | .... | n_type: 0x5 0x308-0x30b.7 (4)
0x0300| 47 4e 55 00| GNU.| name: "GNU" 0x30c-0x30f.7 (4)
0x0310|01 00 01 c0 04 00 00 00 01 00 00 00 00 00 00 00|................| desc: raw bits 0x310-0x32f.7 (32)
0x0320|02 00 01 c0 04 00 00 00 00 00 00 00 00 00 00 00|................|
| | | [8]{}: program_header 0x200-0x32f.7 (304)
0x0200|53 e5 74 64 |S.td | type: "os" (1685382483) (Operating system-specific) 0x200-0x203.7 (4)
| | | flags{}: 0x204-0x207.7 (4)

10
format/elf/testdata/linux_amd64/a_stripped.fqtest vendored
View File

@ -151,8 +151,14 @@ $ fq -d elf dv a_stripped
0x01e0| 30 00 00 00 00 00 00 00| 0.......| filesz: 48 0x1e8-0x1ef.7 (8)
0x01f0|30 00 00 00 00 00 00 00 |0....... | memsz: 48 0x1f0-0x1f7.7 (8)
0x01f0| 08 00 00 00 00 00 00 00| ........| align: 8 0x1f8-0x1ff.7 (8)
0x0300|04 00 00 00 20 00 00 00 05 00 00 00 47 4e 55 00|.... .......GNU.| data: raw bits 0x300-0x32f.7 (48)
* |until 0x32f.7 (48) | |
| | | notes[0:1]: 0x300-0x32f.7 (48)
| | | [0]{}: note 0x300-0x32f.7 (48)
0x0300|04 00 00 00 |.... | n_namesz: 4 0x300-0x303.7 (4)
0x0300| 20 00 00 00 | ... | n_descsz: 32 0x304-0x307.7 (4)
0x0300| 05 00 00 00 | .... | n_type: 0x5 0x308-0x30b.7 (4)
0x0300| 47 4e 55 00| GNU.| name: "GNU" 0x30c-0x30f.7 (4)
0x0310|01 00 01 c0 04 00 00 00 01 00 00 00 00 00 00 00|................| desc: raw bits 0x310-0x32f.7 (32)
0x0320|02 00 01 c0 04 00 00 00 00 00 00 00 00 00 00 00|................|
| | | [8]{}: program_header 0x200-0x32f.7 (304)
0x0200|53 e5 74 64 |S.td | type: "os" (1685382483) (Operating system-specific) 0x200-0x203.7 (4)
| | | flags{}: 0x204-0x207.7 (4)

BIN
format/elf/testdata/linux_amd64/coredump vendored Normal file
View File

Binary file not shown.

376
format/elf/testdata/linux_amd64/coredump.fqtest vendored Normal file
View File

@ -0,0 +1,376 @@
$ fq -d elf dv coredump
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: coredump (elf) 0x0-0x31fff.7 (204800)
| | | header{}: 0x0-0x3f.7 (64)
| | | ident{}: 0x0-0xf.7 (16)
0x00000|7f 45 4c 46 |.ELF | magic: raw bits (valid) 0x0-0x3.7 (4)
0x00000| 02 | . | class: 64 (2) 0x4-0x4.7 (1)
0x00000| 01 | . | data: "little_endian" (1) 0x5-0x5.7 (1)
0x00000| 01 | . | version: 1 0x6-0x6.7 (1)
0x00000| 00 | . | os_abi: "sysv" (0) 0x7-0x7.7 (1)
0x00000| 00 | . | abi_version: 0 0x8-0x8.7 (1)
0x00000| 00 00 00 00 00 00 00| .......| pad: raw bits (all zero) 0x9-0xf.7 (7)
0x00010|04 00 |.. | type: "core" (0x4) 0x10-0x11.7 (2)
0x00010| 3e 00 | >. | machine: "x86_64" (0x3e) (AMD x86-64) 0x12-0x13.7 (2)
0x00010| 01 00 00 00 | .... | version: 1 0x14-0x17.7 (4)
0x00010| 00 00 00 00 00 00 00 00| ........| entry: 0 0x18-0x1f.7 (8)
0x00020|40 00 00 00 00 00 00 00 |@....... | phoff: 64 0x20-0x27.7 (8)
0x00020| 00 00 00 00 00 00 00 00| ........| shoff: 0 0x28-0x2f.7 (8)
0x00030|00 00 00 00 |.... | flags: 0 0x30-0x33.7 (4)
0x00030| 40 00 | @. | ehsize: 64 0x34-0x35.7 (2)
0x00030| 38 00 | 8. | phentsize: 56 0x36-0x37.7 (2)
0x00030| 12 00 | .. | phnum: 18 0x38-0x39.7 (2)
0x00030| 00 00 | .. | shentsize: 0 0x3a-0x3b.7 (2)
0x00030| 00 00 | .. | shnum: 0 0x3c-0x3d.7 (2)
0x00030| 00 00| ..| shstrndx: 0 0x3e-0x3f.7 (2)
| | | program_headers[0:18]: 0x40-0x31fff.7 (204736)
| | | [0]{}: program_header 0x40-0x1007.7 (4040)
0x00040|04 00 00 00 |.... | type: "note" (4) (Auxiliary information) 0x40-0x43.7 (4)
| | | flags{}: 0x44-0x47.7 (4)
0x00040| 00 | . | unused0: 0 0x44-0x44.4 (0.5)
0x00040| 00 | . | r: false 0x44.5-0x44.5 (0.1)
0x00040| 00 | . | w: false 0x44.6-0x44.6 (0.1)
0x00040| 00 | . | x: false 0x44.7-0x44.7 (0.1)
0x00040| 00 00 00 | ... | unused1: 0 0x45-0x47.7 (3)
0x00040| 30 04 00 00 00 00 00 00| 0.......| offset: 0x430 0x48-0x4f.7 (8)
0x00050|00 00 00 00 00 00 00 00 |........ | vaddr: 0x0 0x50-0x57.7 (8)
0x00050| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x58-0x5f.7 (8)
0x00060|d8 0b 00 00 00 00 00 00 |........ | filesz: 3032 0x60-0x67.7 (8)
0x00060| 00 00 00 00 00 00 00 00| ........| memsz: 0 0x68-0x6f.7 (8)
0x00070|00 00 00 00 00 00 00 00 |........ | align: 0 0x70-0x77.7 (8)
| | | notes[0:7]: 0x430-0x1007.7 (3032)
| | | [0]{}: note 0x430-0x593.7 (356)
0x00430|05 00 00 00 |.... | n_namesz: 5 0x430-0x433.7 (4)
0x00430| 50 01 00 00 | P... | n_descsz: 336 0x434-0x437.7 (4)
0x00430| 01 00 00 00 | .... | n_type: "prstatus" (0x1) 0x438-0x43b.7 (4)
0x00430| 43 4f 52 45| CORE| name: "CORE" 0x43c-0x440.7 (5)
0x00440|00 |. |
0x00440| 00 00 00 | ... | name_align: raw bits 0x441-0x443.7 (3)
0x00440| 0b 00 00 00 00 00 00 00 00 00 00 00| ............| desc: raw bits 0x444-0x593.7 (336)
0x00450|0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x593.7 (336) | |
| | | [1]{}: note 0x594-0x62f.7 (156)
0x00590| 05 00 00 00 | .... | n_namesz: 5 0x594-0x597.7 (4)
0x00590| 88 00 00 00 | .... | n_descsz: 136 0x598-0x59b.7 (4)
0x00590| 03 00 00 00| ....| n_type: "prpsinfo" (0x3) 0x59c-0x59f.7 (4)
0x005a0|43 4f 52 45 00 |CORE. | name: "CORE" 0x5a0-0x5a4.7 (5)
0x005a0| 00 00 00 | ... | name_align: raw bits 0x5a5-0x5a7.7 (3)
0x005a0| 00 52 00 00 00 00 00 00| .R......| desc: raw bits 0x5a8-0x62f.7 (136)
0x005b0|00 06 40 00 00 00 00 00 00 00 00 00 00 00 00 00|..@.............|
* |until 0x62f.7 (136) | |
| | | [2]{}: note 0x630-0x6c3.7 (148)
0x00630|05 00 00 00 |.... | n_namesz: 5 0x630-0x633.7 (4)
0x00630| 80 00 00 00 | .... | n_descsz: 128 0x634-0x637.7 (4)
0x00630| 49 47 49 53 | IGIS | n_type: "siginfo" (0x53494749) (Signal info) 0x638-0x63b.7 (4)
0x00630| 43 4f 52 45| CORE| name: "CORE" 0x63c-0x640.7 (5)
0x00640|00 |. |
0x00640| 00 00 00 | ... | name_align: raw bits 0x641-0x643.7 (3)
0x00640| 0b 00 00 00 00 00 00 00 01 00 00 00| ............| desc: raw bits 0x644-0x6c3.7 (128)
0x00650|00 00 00 00 44 33 22 11 00 00 00 00 00 00 00 00|....D3".........|
* |until 0x6c3.7 (128) | |
| | | [3]{}: note 0x6c4-0x817.7 (340)
0x006c0| 05 00 00 00 | .... | n_namesz: 5 0x6c4-0x6c7.7 (4)
0x006c0| 40 01 00 00 | @... | n_descsz: 320 0x6c8-0x6cb.7 (4)
0x006c0| 06 00 00 00| ....| n_type: "auxv" (0x6) 0x6cc-0x6cf.7 (4)
0x006d0|43 4f 52 45 00 |CORE. | name: "CORE" 0x6d0-0x6d4.7 (5)
0x006d0| 00 00 00 | ... | name_align: raw bits 0x6d5-0x6d7.7 (3)
0x006d0| 21 00 00 00 00 00 00 00| !.......| desc: raw bits 0x6d8-0x817.7 (320)
0x006e0|00 c0 87 9e fe 7f 00 00 10 00 00 00 00 00 00 00|................|
* |until 0x817.7 (320) | |
| | | [4]{}: note 0x818-0xa9f.7 (648)
0x00810| 05 00 00 00 | .... | n_namesz: 5 0x818-0x81b.7 (4)
0x00810| 72 02 00 00| r...| n_descsz: 626 0x81c-0x81f.7 (4)
0x00820|45 4c 49 46 |ELIF | n_type: "file" (0x46494c45) (File info) 0x820-0x823.7 (4)
0x00820| 43 4f 52 45 00 | CORE. | name: "CORE" 0x824-0x828.7 (5)
0x00820| 00 00 00 | ... | name_align: raw bits 0x829-0x82b.7 (3)
0x00820| 0a 00 00 00| ....| desc: raw bits 0x82c-0xa9d.7 (626)
0x00830|00 00 00 00 00 10 00 00 00 00 00 00 00 c0 63 e6|..............c.|
* |until 0xa9d.7 (626) | |
0x00a90| 00 00| ..| decs_align: raw bits 0xa9e-0xa9f.7 (2)
| | | [5]{}: note 0xaa0-0xcb3.7 (532)
0x00aa0|05 00 00 00 |.... | n_namesz: 5 0xaa0-0xaa3.7 (4)
0x00aa0| 00 02 00 00 | .... | n_descsz: 512 0xaa4-0xaa7.7 (4)
0x00aa0| 02 00 00 00 | .... | n_type: "prfpreg" (0x2) 0xaa8-0xaab.7 (4)
0x00aa0| 43 4f 52 45| CORE| name: "CORE" 0xaac-0xab0.7 (5)
0x00ab0|00 |. |
0x00ab0| 00 00 00 | ... | name_align: raw bits 0xab1-0xab3.7 (3)
0x00ab0| 7f 03 00 00 00 00 00 00 00 00 00 00| ............| desc: raw bits 0xab4-0xcb3.7 (512)
0x00ac0|00 00 00 00 00 00 00 00 00 00 00 00 80 1f 00 00|................|
* |until 0xcb3.7 (512) | |
| | | [6]{}: note 0xcb4-0x1007.7 (852)
0x00cb0| 06 00 00 00 | .... | n_namesz: 6 0xcb4-0xcb7.7 (4)
0x00cb0| 40 03 00 00 | @... | n_descsz: 832 0xcb8-0xcbb.7 (4)
0x00cb0| 02 02 00 00| ....| n_type: "x86_xstate" (0x202) (x86 extended state using xsave) 0xcbc-0xcbf.7 (4)
0x00cc0|4c 49 4e 55 58 00 |LINUX. | name: "LINUX" 0xcc0-0xcc5.7 (6)
0x00cc0| 00 00 | .. | name_align: raw bits 0xcc6-0xcc7.7 (2)
0x00cc0| 7f 03 00 00 00 00 00 00| ........| desc: raw bits 0xcc8-0x1007.7 (832)
0x00cd0|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x1007.7 (832) | |
| | | [1]{}: program_header 0x78-0x1fff.7 (8072)
0x00070| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x78-0x7b.7 (4)
| | | flags{}: 0x7c-0x7f.7 (4)
0x00070| 04 | . | unused0: 0 0x7c-0x7c.4 (0.5)
0x00070| 04 | . | r: true 0x7c.5-0x7c.5 (0.1)
0x00070| 04 | . | w: false 0x7c.6-0x7c.6 (0.1)
0x00070| 04 | . | x: false 0x7c.7-0x7c.7 (0.1)
0x00070| 00 00 00| ...| unused1: 0 0x7d-0x7f.7 (3)
0x00080|00 20 00 00 00 00 00 00 |. ...... | offset: 0x2000 0x80-0x87.7 (8)
0x00080| 00 c0 63 e6 e9 55 00 00| ..c..U..| vaddr: 0x55e9e663c000 0x88-0x8f.7 (8)
0x00090|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x90-0x97.7 (8)
0x00090| 00 00 00 00 00 00 00 00| ........| filesz: 0 0x98-0x9f.7 (8)
0x000a0|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0xa0-0xa7.7 (8)
0x000a0| 00 10 00 00 00 00 00 00| ........| align: 4096 0xa8-0xaf.7 (8)
| | | data: raw bits 0x2000-NA (0)
| | | [2]{}: program_header 0xb0-0x1fff.7 (8016)
0x000b0|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0xb0-0xb3.7 (4)
| | | flags{}: 0xb4-0xb7.7 (4)
0x000b0| 05 | . | unused0: 0 0xb4-0xb4.4 (0.5)
0x000b0| 05 | . | r: true 0xb4.5-0xb4.5 (0.1)
0x000b0| 05 | . | w: false 0xb4.6-0xb4.6 (0.1)
0x000b0| 05 | . | x: true 0xb4.7-0xb4.7 (0.1)
0x000b0| 00 00 00 | ... | unused1: 0 0xb5-0xb7.7 (3)
0x000b0| 00 20 00 00 00 00 00 00| . ......| offset: 0x2000 0xb8-0xbf.7 (8)
0x000c0|00 d0 63 e6 e9 55 00 00 |..c..U.. | vaddr: 0x55e9e663d000 0xc0-0xc7.7 (8)
0x000c0| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0xc8-0xcf.7 (8)
0x000d0|00 00 00 00 00 00 00 00 |........ | filesz: 0 0xd0-0xd7.7 (8)
0x000d0| 00 10 00 00 00 00 00 00| ........| memsz: 4096 0xd8-0xdf.7 (8)
0x000e0|00 10 00 00 00 00 00 00 |........ | align: 4096 0xe0-0xe7.7 (8)
| | | data: raw bits 0x2000-NA (0)
| | | [3]{}: program_header 0xe8-0x1fff.7 (7960)
0x000e0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0xe8-0xeb.7 (4)
| | | flags{}: 0xec-0xef.7 (4)
0x000e0| 04 | . | unused0: 0 0xec-0xec.4 (0.5)
0x000e0| 04 | . | r: true 0xec.5-0xec.5 (0.1)
0x000e0| 04 | . | w: false 0xec.6-0xec.6 (0.1)
0x000e0| 04 | . | x: false 0xec.7-0xec.7 (0.1)
0x000e0| 00 00 00| ...| unused1: 0 0xed-0xef.7 (3)
0x000f0|00 20 00 00 00 00 00 00 |. ...... | offset: 0x2000 0xf0-0xf7.7 (8)
0x000f0| 00 e0 63 e6 e9 55 00 00| ..c..U..| vaddr: 0x55e9e663e000 0xf8-0xff.7 (8)
0x00100|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x100-0x107.7 (8)
0x00100| 00 00 00 00 00 00 00 00| ........| filesz: 0 0x108-0x10f.7 (8)
0x00110|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x110-0x117.7 (8)
0x00110| 00 10 00 00 00 00 00 00| ........| align: 4096 0x118-0x11f.7 (8)
| | | data: raw bits 0x2000-NA (0)
| | | [4]{}: program_header 0x120-0x2fff.7 (12000)
0x00120|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x120-0x123.7 (4)
| | | flags{}: 0x124-0x127.7 (4)
0x00120| 04 | . | unused0: 0 0x124-0x124.4 (0.5)
0x00120| 04 | . | r: true 0x124.5-0x124.5 (0.1)
0x00120| 04 | . | w: false 0x124.6-0x124.6 (0.1)
0x00120| 04 | . | x: false 0x124.7-0x124.7 (0.1)
0x00120| 00 00 00 | ... | unused1: 0 0x125-0x127.7 (3)
0x00120| 00 20 00 00 00 00 00 00| . ......| offset: 0x2000 0x128-0x12f.7 (8)
0x00130|00 f0 63 e6 e9 55 00 00 |..c..U.. | vaddr: 0x55e9e663f000 0x130-0x137.7 (8)
0x00130| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x138-0x13f.7 (8)
0x00140|00 10 00 00 00 00 00 00 |........ | filesz: 4096 0x140-0x147.7 (8)
0x00140| 00 10 00 00 00 00 00 00| ........| memsz: 4096 0x148-0x14f.7 (8)
0x00150|00 10 00 00 00 00 00 00 |........ | align: 4096 0x150-0x157.7 (8)
0x02000|01 1b 03 3b 24 00 00 00 03 00 00 00 10 f0 ff ff|...;$...........| data: raw bits 0x2000-0x2fff.7 (4096)
* |until 0x2fff.7 (4096) | |
| | | [5]{}: program_header 0x158-0x3fff.7 (16040)
0x00150| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x158-0x15b.7 (4)
| | | flags{}: 0x15c-0x15f.7 (4)
0x00150| 06 | . | unused0: 0 0x15c-0x15c.4 (0.5)
0x00150| 06 | . | r: true 0x15c.5-0x15c.5 (0.1)
0x00150| 06 | . | w: true 0x15c.6-0x15c.6 (0.1)
0x00150| 06 | . | x: false 0x15c.7-0x15c.7 (0.1)
0x00150| 00 00 00| ...| unused1: 0 0x15d-0x15f.7 (3)
0x00160|00 30 00 00 00 00 00 00 |.0...... | offset: 0x3000 0x160-0x167.7 (8)
0x00160| 00 00 64 e6 e9 55 00 00| ..d..U..| vaddr: 0x55e9e6640000 0x168-0x16f.7 (8)
0x00170|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x170-0x177.7 (8)
0x00170| 00 10 00 00 00 00 00 00| ........| filesz: 4096 0x178-0x17f.7 (8)
0x00180|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x180-0x187.7 (8)
0x00180| 00 10 00 00 00 00 00 00| ........| align: 4096 0x188-0x18f.7 (8)
0x03000|00 00 64 e6 e9 55 00 00 00 00 00 00 00 00 00 00|..d..U..........| data: raw bits 0x3000-0x3fff.7 (4096)
* |until 0x3fff.7 (4096) | |
| | | [6]{}: program_header 0x190-0x3fff.7 (15984)
0x00190|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x190-0x193.7 (4)
| | | flags{}: 0x194-0x197.7 (4)
0x00190| 00 | . | unused0: 0 0x194-0x194.4 (0.5)
0x00190| 00 | . | r: false 0x194.5-0x194.5 (0.1)
0x00190| 00 | . | w: false 0x194.6-0x194.6 (0.1)
0x00190| 00 | . | x: false 0x194.7-0x194.7 (0.1)
0x00190| 00 00 00 | ... | unused1: 0 0x195-0x197.7 (3)
0x00190| 00 40 00 00 00 00 00 00| .@......| offset: 0x4000 0x198-0x19f.7 (8)
0x001a0|00 00 5f e7 e9 55 00 00 |.._..U.. | vaddr: 0x55e9e75f0000 0x1a0-0x1a7.7 (8)
0x001a0| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x1a8-0x1af.7 (8)
0x001b0|00 00 00 00 00 00 00 00 |........ | filesz: 0 0x1b0-0x1b7.7 (8)
0x001b0| 00 10 00 00 00 00 00 00| ........| memsz: 4096 0x1b8-0x1bf.7 (8)
0x001c0|00 10 00 00 00 00 00 00 |........ | align: 4096 0x1c0-0x1c7.7 (8)
| | | data: raw bits 0x4000-NA (0)
| | | [7]{}: program_header 0x1c8-0x4fff.7 (20024)
0x001c0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x1c8-0x1cb.7 (4)
| | | flags{}: 0x1cc-0x1cf.7 (4)
0x001c0| 06 | . | unused0: 0 0x1cc-0x1cc.4 (0.5)
0x001c0| 06 | . | r: true 0x1cc.5-0x1cc.5 (0.1)
0x001c0| 06 | . | w: true 0x1cc.6-0x1cc.6 (0.1)
0x001c0| 06 | . | x: false 0x1cc.7-0x1cc.7 (0.1)
0x001c0| 00 00 00| ...| unused1: 0 0x1cd-0x1cf.7 (3)
0x001d0|00 40 00 00 00 00 00 00 |.@...... | offset: 0x4000 0x1d0-0x1d7.7 (8)
0x001d0| 00 10 5f e7 e9 55 00 00| .._..U..| vaddr: 0x55e9e75f1000 0x1d8-0x1df.7 (8)
0x001e0|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x1e0-0x1e7.7 (8)
0x001e0| 00 10 00 00 00 00 00 00| ........| filesz: 4096 0x1e8-0x1ef.7 (8)
0x001f0|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x1f0-0x1f7.7 (8)
0x001f0| 00 10 00 00 00 00 00 00| ........| align: 4096 0x1f8-0x1ff.7 (8)
0x04000|e2 14 cb 78 67 54 a6 56 00 00 00 00 00 00 00 00|...xgT.V........| data: raw bits 0x4000-0x4fff.7 (4096)
* |until 0x4fff.7 (4096) | |
| | | [8]{}: program_header 0x200-0x4fff.7 (19968)
0x00200|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x200-0x203.7 (4)
| | | flags{}: 0x204-0x207.7 (4)
0x00200| 04 | . | unused0: 0 0x204-0x204.4 (0.5)
0x00200| 04 | . | r: true 0x204.5-0x204.5 (0.1)
0x00200| 04 | . | w: false 0x204.6-0x204.6 (0.1)
0x00200| 04 | . | x: false 0x204.7-0x204.7 (0.1)
0x00200| 00 00 00 | ... | unused1: 0 0x205-0x207.7 (3)
0x00200| 00 50 00 00 00 00 00 00| .P......| offset: 0x5000 0x208-0x20f.7 (8)
0x00210|00 10 25 0a 2e 7f 00 00 |..%..... | vaddr: 0x7f2e0a251000 0x210-0x217.7 (8)
0x00210| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x218-0x21f.7 (8)
0x00220|00 00 00 00 00 00 00 00 |........ | filesz: 0 0x220-0x227.7 (8)
0x00220| 00 50 01 00 00 00 00 00| .P......| memsz: 86016 0x228-0x22f.7 (8)
0x00230|00 10 00 00 00 00 00 00 |........ | align: 4096 0x230-0x237.7 (8)
| | | data: raw bits 0x5000-NA (0)
| | | [9]{}: program_header 0x238-0x4fff.7 (19912)
0x00230| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x238-0x23b.7 (4)
| | | flags{}: 0x23c-0x23f.7 (4)
0x00230| 05 | . | unused0: 0 0x23c-0x23c.4 (0.5)
0x00230| 05 | . | r: true 0x23c.5-0x23c.5 (0.1)
0x00230| 05 | . | w: false 0x23c.6-0x23c.6 (0.1)
0x00230| 05 | . | x: true 0x23c.7-0x23c.7 (0.1)
0x00230| 00 00 00| ...| unused1: 0 0x23d-0x23f.7 (3)
0x00240|00 50 00 00 00 00 00 00 |.P...... | offset: 0x5000 0x240-0x247.7 (8)
0x00240| 00 60 26 0a 2e 7f 00 00| .`&.....| vaddr: 0x7f2e0a266000 0x248-0x24f.7 (8)
0x00250|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x250-0x257.7 (8)
0x00250| 00 00 00 00 00 00 00 00| ........| filesz: 0 0x258-0x25f.7 (8)
0x00260|00 80 04 00 00 00 00 00 |........ | memsz: 294912 0x260-0x267.7 (8)
0x00260| 00 10 00 00 00 00 00 00| ........| align: 4096 0x268-0x26f.7 (8)
| | | data: raw bits 0x5000-NA (0)
| | | [10]{}: program_header 0x270-0x4fff.7 (19856)
0x00270|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x270-0x273.7 (4)
| | | flags{}: 0x274-0x277.7 (4)
0x00270| 04 | . | unused0: 0 0x274-0x274.4 (0.5)
0x00270| 04 | . | r: true 0x274.5-0x274.5 (0.1)
0x00270| 04 | . | w: false 0x274.6-0x274.6 (0.1)
0x00270| 04 | . | x: false 0x274.7-0x274.7 (0.1)
0x00270| 00 00 00 | ... | unused1: 0 0x275-0x277.7 (3)
0x00270| 00 50 00 00 00 00 00 00| .P......| offset: 0x5000 0x278-0x27f.7 (8)
0x00280|00 e0 2a 0a 2e 7f 00 00 |..*..... | vaddr: 0x7f2e0a2ae000 0x280-0x287.7 (8)
0x00280| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x288-0x28f.7 (8)
0x00290|00 00 00 00 00 00 00 00 |........ | filesz: 0 0x290-0x297.7 (8)
0x00290| 00 60 03 00 00 00 00 00| .`......| memsz: 221184 0x298-0x29f.7 (8)
0x002a0|00 10 00 00 00 00 00 00 |........ | align: 4096 0x2a0-0x2a7.7 (8)
| | | data: raw bits 0x5000-NA (0)
| | | [11]{}: program_header 0x2a8-0x5fff.7 (23896)
0x002a0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x2a8-0x2ab.7 (4)
| | | flags{}: 0x2ac-0x2af.7 (4)
0x002a0| 04 | . | unused0: 0 0x2ac-0x2ac.4 (0.5)
0x002a0| 04 | . | r: true 0x2ac.5-0x2ac.5 (0.1)
0x002a0| 04 | . | w: false 0x2ac.6-0x2ac.6 (0.1)
0x002a0| 04 | . | x: false 0x2ac.7-0x2ac.7 (0.1)
0x002a0| 00 00 00| ...| unused1: 0 0x2ad-0x2af.7 (3)
0x002b0|00 50 00 00 00 00 00 00 |.P...... | offset: 0x5000 0x2b0-0x2b7.7 (8)
0x002b0| 00 40 2e 0a 2e 7f 00 00| .@......| vaddr: 0x7f2e0a2e4000 0x2b8-0x2bf.7 (8)
0x002c0|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x2c0-0x2c7.7 (8)
0x002c0| 00 10 00 00 00 00 00 00| ........| filesz: 4096 0x2c8-0x2cf.7 (8)
0x002d0|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x2d0-0x2d7.7 (8)
0x002d0| 00 10 00 00 00 00 00 00| ........| align: 4096 0x2d8-0x2df.7 (8)
0x05000|66 2f 65 78 65 00 25 2e 2a 73 2f 65 74 63 2f 6c|f/exe.%.*s/etc/l| data: raw bits 0x5000-0x5fff.7 (4096)
* |until 0x5fff.7 (4096) | |
| | | [12]{}: program_header 0x2e0-0x6fff.7 (27936)
0x002e0|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x2e0-0x2e3.7 (4)
| | | flags{}: 0x2e4-0x2e7.7 (4)
0x002e0| 06 | . | unused0: 0 0x2e4-0x2e4.4 (0.5)
0x002e0| 06 | . | r: true 0x2e4.5-0x2e4.5 (0.1)
0x002e0| 06 | . | w: true 0x2e4.6-0x2e4.6 (0.1)
0x002e0| 06 | . | x: false 0x2e4.7-0x2e4.7 (0.1)
0x002e0| 00 00 00 | ... | unused1: 0 0x2e5-0x2e7.7 (3)
0x002e0| 00 60 00 00 00 00 00 00| .`......| offset: 0x6000 0x2e8-0x2ef.7 (8)
0x002f0|00 50 2e 0a 2e 7f 00 00 |.P...... | vaddr: 0x7f2e0a2e5000 0x2f0-0x2f7.7 (8)
0x002f0| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x2f8-0x2ff.7 (8)
0x00300|00 10 00 00 00 00 00 00 |........ | filesz: 4096 0x300-0x307.7 (8)
0x00300| 00 10 00 00 00 00 00 00| ........| memsz: 4096 0x308-0x30f.7 (8)
0x00310|00 10 00 00 00 00 00 00 |........ | align: 4096 0x310-0x317.7 (8)
0x06000|ca 28 2e 0a 2e 7f 00 00 d0 28 2e 0a 2e 7f 00 00|.(.......(......| data: raw bits 0x6000-0x6fff.7 (4096)
* |until 0x6fff.7 (4096) | |
| | | [13]{}: program_header 0x318-0x9fff.7 (40168)
0x00310| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x318-0x31b.7 (4)
| | | flags{}: 0x31c-0x31f.7 (4)
0x00310| 06 | . | unused0: 0 0x31c-0x31c.4 (0.5)
0x00310| 06 | . | r: true 0x31c.5-0x31c.5 (0.1)
0x00310| 06 | . | w: true 0x31c.6-0x31c.6 (0.1)
0x00310| 06 | . | x: false 0x31c.7-0x31c.7 (0.1)
0x00310| 00 00 00| ...| unused1: 0 0x31d-0x31f.7 (3)
0x00320|00 70 00 00 00 00 00 00 |.p...... | offset: 0x7000 0x320-0x327.7 (8)
0x00320| 00 60 2e 0a 2e 7f 00 00| .`......| vaddr: 0x7f2e0a2e6000 0x328-0x32f.7 (8)
0x00330|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x330-0x337.7 (8)
0x00330| 00 30 00 00 00 00 00 00| .0......| filesz: 12288 0x338-0x33f.7 (8)
0x00340|00 30 00 00 00 00 00 00 |.0...... | memsz: 12288 0x340-0x347.7 (8)
0x00340| 00 10 00 00 00 00 00 00| ........| align: 4096 0x348-0x34f.7 (8)
0x07000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0x7000-0x9fff.7 (12288)
* |until 0x9fff.7 (12288) | |
| | | [14]{}: program_header 0x350-0x2afff.7 (175280)
0x00350|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x350-0x353.7 (4)
| | | flags{}: 0x354-0x357.7 (4)
0x00350| 06 | . | unused0: 0 0x354-0x354.4 (0.5)
0x00350| 06 | . | r: true 0x354.5-0x354.5 (0.1)
0x00350| 06 | . | w: true 0x354.6-0x354.6 (0.1)
0x00350| 06 | . | x: false 0x354.7-0x354.7 (0.1)
0x00350| 00 00 00 | ... | unused1: 0 0x355-0x357.7 (3)
0x00350| 00 a0 00 00 00 00 00 00| ........| offset: 0xa000 0x358-0x35f.7 (8)
0x00360|00 20 7e 9e fe 7f 00 00 |. ~..... | vaddr: 0x7ffe9e7e2000 0x360-0x367.7 (8)
0x00360| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x368-0x36f.7 (8)
0x00370|00 10 02 00 00 00 00 00 |........ | filesz: 135168 0x370-0x377.7 (8)
0x00370| 00 10 02 00 00 00 00 00| ........| memsz: 135168 0x378-0x37f.7 (8)
0x00380|00 10 00 00 00 00 00 00 |........ | align: 4096 0x380-0x387.7 (8)
0x0a000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0xa000-0x2afff.7 (135168)
* |until 0x2afff.7 (135168) | |
| | | [15]{}: program_header 0x388-0x2efff.7 (191608)
0x00380| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x388-0x38b.7 (4)
| | | flags{}: 0x38c-0x38f.7 (4)
0x00380| 04 | . | unused0: 0 0x38c-0x38c.4 (0.5)
0x00380| 04 | . | r: true 0x38c.5-0x38c.5 (0.1)
0x00380| 04 | . | w: false 0x38c.6-0x38c.6 (0.1)
0x00380| 04 | . | x: false 0x38c.7-0x38c.7 (0.1)
0x00380| 00 00 00| ...| unused1: 0 0x38d-0x38f.7 (3)
0x00390|00 b0 02 00 00 00 00 00 |........ | offset: 0x2b000 0x390-0x397.7 (8)
0x00390| 00 80 87 9e fe 7f 00 00| ........| vaddr: 0x7ffe9e878000 0x398-0x39f.7 (8)
0x003a0|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x3a0-0x3a7.7 (8)
0x003a0| 00 40 00 00 00 00 00 00| .@......| filesz: 16384 0x3a8-0x3af.7 (8)
0x003b0|00 40 00 00 00 00 00 00 |.@...... | memsz: 16384 0x3b0-0x3b7.7 (8)
0x003b0| 00 10 00 00 00 00 00 00| ........| align: 4096 0x3b8-0x3bf.7 (8)
0x2b000|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................| data: raw bits 0x2b000-0x2efff.7 (16384)
* |until 0x2efff.7 (16384) | |
| | | [16]{}: program_header 0x3c0-0x30fff.7 (199744)
0x003c0|01 00 00 00 |.... | type: "load" (1) (Loadable segment) 0x3c0-0x3c3.7 (4)
| | | flags{}: 0x3c4-0x3c7.7 (4)
0x003c0| 05 | . | unused0: 0 0x3c4-0x3c4.4 (0.5)
0x003c0| 05 | . | r: true 0x3c4.5-0x3c4.5 (0.1)
0x003c0| 05 | . | w: false 0x3c4.6-0x3c4.6 (0.1)
0x003c0| 05 | . | x: true 0x3c4.7-0x3c4.7 (0.1)
0x003c0| 00 00 00 | ... | unused1: 0 0x3c5-0x3c7.7 (3)
0x003c0| 00 f0 02 00 00 00 00 00| ........| offset: 0x2f000 0x3c8-0x3cf.7 (8)
0x003d0|00 c0 87 9e fe 7f 00 00 |........ | vaddr: 0x7ffe9e87c000 0x3d0-0x3d7.7 (8)
0x003d0| 00 00 00 00 00 00 00 00| ........| paddr: 0x0 0x3d8-0x3df.7 (8)
0x003e0|00 20 00 00 00 00 00 00 |. ...... | filesz: 8192 0x3e0-0x3e7.7 (8)
0x003e0| 00 20 00 00 00 00 00 00| . ......| memsz: 8192 0x3e8-0x3ef.7 (8)
0x003f0|00 10 00 00 00 00 00 00 |........ | align: 4096 0x3f0-0x3f7.7 (8)
0x2f000|7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00|.ELF............| data: raw bits 0x2f000-0x30fff.7 (8192)
* |until 0x30fff.7 (8192) | |
| | | [17]{}: program_header 0x3f8-0x31fff.7 (203784)
0x003f0| 01 00 00 00 | .... | type: "load" (1) (Loadable segment) 0x3f8-0x3fb.7 (4)
| | | flags{}: 0x3fc-0x3ff.7 (4)
0x003f0| 05 | . | unused0: 0 0x3fc-0x3fc.4 (0.5)
0x003f0| 05 | . | r: true 0x3fc.5-0x3fc.5 (0.1)
0x003f0| 05 | . | w: false 0x3fc.6-0x3fc.6 (0.1)
0x003f0| 05 | . | x: true 0x3fc.7-0x3fc.7 (0.1)
0x003f0| 00 00 00| ...| unused1: 0 0x3fd-0x3ff.7 (3)
0x00400|00 10 03 00 00 00 00 00 |........ | offset: 0x31000 0x400-0x407.7 (8)
0x00400| 00 00 60 ff ff ff ff ff| ..`.....| vaddr: 0xffffffffff600000 0x408-0x40f.7 (8)
0x00410|00 00 00 00 00 00 00 00 |........ | paddr: 0x0 0x410-0x417.7 (8)
0x00410| 00 10 00 00 00 00 00 00| ........| filesz: 4096 0x418-0x41f.7 (8)
0x00420|00 10 00 00 00 00 00 00 |........ | memsz: 4096 0x420-0x427.7 (8)
0x00420| 00 10 00 00 00 00 00 00| ........| align: 4096 0x428-0x42f.7 (8)
0x31000|48 c7 c0 60 00 00 00 0f 05 c3 cc cc cc cc cc cc|H..`............| data: raw bits 0x31000-0x31fff.7 (4096)
* |until 0x31fff.7 (end) (4096) | |
| | | section_headers[0:0]: 0x430-NA (0)
0x01000| 00 00 00 00 00 00 00 00| ........| unknown0: raw bits 0x1008-0x1fff.7 (4088)
0x01010|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|................|
* |until 0x1fff.7 (4088) | |

10
format/elf/testdata/linux_amd64/libbbb.so.fqtest vendored
View File

@ -119,8 +119,14 @@ $ fq -d elf dv libbbb.so
0x0170| 30 00 00 00 00 00 00 00| 0.......| filesz: 48 0x178-0x17f.7 (8)
0x0180|30 00 00 00 00 00 00 00 |0....... | memsz: 48 0x180-0x187.7 (8)
0x0180| 08 00 00 00 00 00 00 00| ........| align: 8 0x188-0x18f.7 (8)
0x20b0|04 00 00 00 20 00 00 00 05 00 00 00 47 4e 55 00|.... .......GNU.| data: raw bits 0x20b0-0x20df.7 (48)
* |until 0x20df.7 (48) | |
| | | notes[0:1]: 0x20b0-0x20df.7 (48)
| | | [0]{}: note 0x20b0-0x20df.7 (48)
0x20b0|04 00 00 00 |.... | n_namesz: 4 0x20b0-0x20b3.7 (4)
0x20b0| 20 00 00 00 | ... | n_descsz: 32 0x20b4-0x20b7.7 (4)
0x20b0| 05 00 00 00 | .... | n_type: 0x5 0x20b8-0x20bb.7 (4)
0x20b0| 47 4e 55 00| GNU.| name: "GNU" 0x20bc-0x20bf.7 (4)
0x20c0|01 00 01 c0 04 00 00 00 01 00 00 00 00 00 00 00|................| desc: raw bits 0x20c0-0x20df.7 (32)
0x20d0|02 00 01 c0 04 00 00 00 00 00 00 00 00 00 00 00|................|
| | | [6]{}: program_header 0x190-0x20df.7 (8016)
0x0190|53 e5 74 64 |S.td | type: "os" (1685382483) (Operating system-specific) 0x190-0x193.7 (4)
| | | flags{}: 0x194-0x197.7 (4)