#------------------------------------------------------------------------------ # elftools tests # # Maxim Akhmedov (max42@yandex-team.ru) # This code is in the public domain #------------------------------------------------------------------------------ import unittest import os from elftools.elf.elffile import ELFFile from elftools.elf.segments import NoteSegment class TestCoreNotes(unittest.TestCase): """ This test makes sure than core dump specific sections are properly analyzed. """ @classmethod def setUpClass(cls): cls._core_file = open(os.path.join('test', 'testfiles_for_unittests', 'core_linux64.elf'), 'rb') def test_core_prpsinfo(self): elf = ELFFile(self._core_file) for segment in elf.iter_segments(): if not isinstance(segment, NoteSegment): continue notes = list(segment.iter_notes()) for note in segment.iter_notes(): if note['n_type'] != 'NT_PRPSINFO': continue desc = note['n_desc'] self.assertEqual(desc['pr_state'], 0) self.assertEqual(desc['pr_sname'], b'R') self.assertEqual(desc['pr_zomb'], 0) self.assertEqual(desc['pr_nice'], 0) self.assertEqual(desc['pr_flag'], 0x400600) self.assertEqual(desc['pr_uid'], 1000) self.assertEqual(desc['pr_gid'], 1000) self.assertEqual(desc['pr_pid'], 23395) self.assertEqual(desc['pr_ppid'], 23187) self.assertEqual(desc['pr_pgrp'], 23395) self.assertEqual(desc['pr_sid'], 23187) self.assertEqual( desc['pr_fname'], b'coredump_self\x00\x00\x00') self.assertEqual( desc['pr_psargs'], b'./coredump_self foo bar 42 ' + b'\x00' * (80 - 27)) def test_core_nt_file(self): """ Test that the parsing of the NT_FILE note within a core file is correct. The assertions are made against the output of eu-readelf. eu-readelf -n core_linux64.elf ... CORE 621 FILE 10 files: 00400000-00401000 00000000 4096 /home/max42/pyelftools/test/coredump_self 00600000-00601000 00000000 4096 /home/max42/pyelftools/test/coredump_self 00601000-00602000 00001000 4096 /home/max42/pyelftools/test/coredump_self 7fa4593ae000-7fa45956d000 00000000 1830912 /lib/x86_64-linux-gnu/libc-2.23.so 7fa45956d000-7fa45976d000 001bf000 2097152 /lib/x86_64-linux-gnu/libc-2.23.so 7fa45976d000-7fa459771000 001bf000 16384 /lib/x86_64-linux-gnu/libc-2.23.so 7fa459771000-7fa459773000 001c3000 8192 /lib/x86_64-linux-gnu/libc-2.23.so 7fa459777000-7fa45979d000 00000000 155648 /lib/x86_64-linux-gnu/ld-2.23.so 7fa45999c000-7fa45999d000 00025000 4096 /lib/x86_64-linux-gnu/ld-2.23.so 7fa45999d000-7fa45999e000 00026000 4096 /lib/x86_64-linux-gnu/ld-2.23.so ... """ elf = ELFFile(self._core_file) nt_file_found = False for segment in elf.iter_segments(): if not isinstance(segment, NoteSegment): continue for note in segment.iter_notes(): if note['n_type'] != 'NT_FILE': continue nt_file_found = True desc = note['n_desc'] self.assertEqual(desc['num_map_entries'], 10) self.assertEqual(desc['page_size'], 4096) self.assertEqual(len(desc['Elf_Nt_File_Entry']), 10) self.assertEqual(len(desc['filename']), 10) self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][0], desc['page_size'], 0x00400000, 0x00401000, 0x00000000) self.assertEqual(desc['filename'][0], b"/home/max42/pyelftools/test/coredump_self") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][1], desc['page_size'], 0x00600000, 0x00601000, 0x00000000) self.assertEqual(desc['filename'][1], b"/home/max42/pyelftools/test/coredump_self") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][2], desc['page_size'], 0x00601000, 0x00602000, 0x00001000) self.assertEqual(desc['filename'][2], b"/home/max42/pyelftools/test/coredump_self") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][3], desc['page_size'], 0x7fa4593ae000, 0x7fa45956d000, 0x00000000) self.assertEqual(desc['filename'][3], b"/lib/x86_64-linux-gnu/libc-2.23.so") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][4], desc['page_size'], 0x7fa45956d000, 0x7fa45976d000, 0x001bf000) self.assertEqual(desc['filename'][4], b"/lib/x86_64-linux-gnu/libc-2.23.so") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][5], desc['page_size'], 0x7fa45976d000, 0x7fa459771000, 0x001bf000) self.assertEqual(desc['filename'][5], b"/lib/x86_64-linux-gnu/libc-2.23.so") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][6], desc['page_size'], 0x7fa459771000, 0x7fa459773000, 0x001c3000) self.assertEqual(desc['filename'][6], b"/lib/x86_64-linux-gnu/libc-2.23.so") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][7], desc['page_size'], 0x7fa459777000, 0x7fa45979d000, 0x00000000) self.assertEqual(desc['filename'][7], b"/lib/x86_64-linux-gnu/ld-2.23.so") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][8], desc['page_size'], 0x7fa45999c000, 0x7fa45999d000, 0x00025000) self.assertEqual(desc['filename'][8], b"/lib/x86_64-linux-gnu/ld-2.23.so") self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][9], desc['page_size'], 0x7fa45999d000, 0x7fa45999e000, 0x00026000) self.assertEqual(desc['filename'][9], b"/lib/x86_64-linux-gnu/ld-2.23.so") self.assertTrue(nt_file_found) def validate_nt_file_entry(self, entry, page_size, expected_vm_start, expected_vm_end, expected_page_offset): self.assertEqual(entry.vm_start, expected_vm_start) self.assertEqual(entry.vm_end, expected_vm_end) self.assertEqual(entry.page_offset * page_size, expected_page_offset) @classmethod def tearDownClass(cls): cls._core_file.close()