test/test_core_notes32.py

   1 #------------------------------------------------------------------------------
   2 # elftools tests
   3 #
   4 # Kyle Zeng (zengyhkyle@asu.edu)
   5 # This code is in the public domain
   6 #------------------------------------------------------------------------------
   7 import unittest
   8 import os
   9
  10 from elftools.elf.elffile import ELFFile
  11 from elftools.elf.segments import NoteSegment
  12
  13
  14 class TestCoreNotes(unittest.TestCase):
  15     """ This test makes sure than core dump specific
  16         sections are properly analyzed.
  17     """
  18     @classmethod
  19     def setUpClass(cls):
  20         cls._core_file = open(os.path.join('test',
  21                               'testfiles_for_unittests', 'core_linux32.elf'),
  22                               'rb')
  23
  24     def test_core_prpsinfo(self):
  25         elf = ELFFile(self._core_file)
  26         for segment in elf.iter_segments():
  27             if not isinstance(segment, NoteSegment):
  28                 continue
  29             notes = list(segment.iter_notes())
  30             for note in segment.iter_notes():
  31                 if note['n_type'] != 'NT_PRPSINFO':
  32                     continue
  33                 desc = note['n_desc']
  34                 self.assertEqual(desc['pr_state'], 0)
  35                 self.assertEqual(desc['pr_sname'], b'R')
  36                 self.assertEqual(desc['pr_zomb'], 0)
  37                 self.assertEqual(desc['pr_nice'], 0)
  38                 self.assertEqual(desc['pr_flag'], 0x400600)
  39                 self.assertEqual(desc['pr_uid'], 1000)
  40                 self.assertEqual(desc['pr_gid'], 1000)
  41                 self.assertEqual(desc['pr_pid'], 11038)
  42                 self.assertEqual(desc['pr_ppid'], 10442)
  43                 self.assertEqual(desc['pr_pgrp'], 11038)
  44                 self.assertEqual(desc['pr_sid'], 10442)
  45                 self.assertEqual(
  46                     desc['pr_fname'],
  47                     b'coredump\x00\x00\x00\x00\x00\x00\x00\x00')
  48                 self.assertEqual(
  49                     desc['pr_psargs'],
  50                     b'./coredump foo bar 42 '.ljust(80, b'\x00'))
  51
  52     def test_core_nt_file(self):
  53         """
  54         Test that the parsing of the NT_FILE note within a core file is
  55         correct.
  56         The assertions are made against the output of eu-readelf.
  57
  58         eu-readelf -n core_linux64.elf
  59         ...
  60         CORE                 0x0000018b NT_FILE (mapped files)
  61         Page size: 4096
  62              Start         End Page Offset
  63         0x56624000  0x56625000  0x00000000
  64             /tmp/coredump
  65         0x56625000  0x56626000  0x00000000
  66             /tmp/coredump
  67         0x56626000  0x56627000  0x00000001
  68             /tmp/coredump
  69         0xf7d13000  0xf7ee8000  0x00000000
  70             /lib/i386-linux-gnu/libc-2.27.so
  71         0xf7ee8000  0xf7ee9000  0x000001d5
  72             /lib/i386-linux-gnu/libc-2.27.so
  73         0xf7ee9000  0xf7eeb000  0x000001d5
  74             /lib/i386-linux-gnu/libc-2.27.so
  75         0xf7eeb000  0xf7eec000  0x000001d7
  76             /lib/i386-linux-gnu/libc-2.27.so
  77         0xf7f39000  0xf7f5f000  0x00000000
  78             /lib/i386-linux-gnu/ld-2.27.so
  79         0xf7f5f000  0xf7f60000  0x00000025
  80             /lib/i386-linux-gnu/ld-2.27.so
  81         0xf7f60000  0xf7f61000  0x00000026
  82             /lib/i386-linux-gnu/ld-2.27.so
  83         ...
  84         """
  85         elf = ELFFile(self._core_file)
  86         nt_file_found = False
  87         for segment in elf.iter_segments():
  88             if not isinstance(segment, NoteSegment):
  89                 continue
  90             for note in segment.iter_notes():
  91                 if note['n_type'] != 'NT_FILE':
  92                     continue
  93                 nt_file_found = True
  94                 desc = note['n_desc']
  95                 self.assertEqual(desc['num_map_entries'], 10)
  96                 self.assertEqual(desc['page_size'], 4096)
  97                 self.assertEqual(len(desc['Elf_Nt_File_Entry']), 10)
  98                 self.assertEqual(len(desc['filename']), 10)
  99
 100                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][0],
 101                                             desc['page_size'],
 102                                             0x56624000, 0x56625000, 0x00000000)
 103                 self.assertEqual(desc['filename'][0],
 104                                  b"/tmp/coredump")
 105
 106                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][1],
 107                                             desc['page_size'],
 108                                             0x56625000, 0x56626000, 0x00000000)
 109                 self.assertEqual(desc['filename'][1],
 110                                  b"/tmp/coredump")
 111
 112                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][2],
 113                                             desc['page_size'],
 114                                             0x56626000, 0x56627000, 0x00000001)
 115                 self.assertEqual(desc['filename'][2],
 116                                  b"/tmp/coredump")
 117
 118                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][3],
 119                                             desc['page_size'],
 120                                             0xf7d13000, 0xf7ee8000, 0x00000000)
 121                 self.assertEqual(desc['filename'][3],
 122                                  b"/lib/i386-linux-gnu/libc-2.27.so")
 123
 124                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][4],
 125                                             desc['page_size'],
 126                                             0xf7ee8000, 0xf7ee9000, 0x000001d5)
 127                 self.assertEqual(desc['filename'][4],
 128                                  b"/lib/i386-linux-gnu/libc-2.27.so")
 129
 130                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][5],
 131                                             desc['page_size'],
 132                                             0xf7ee9000, 0xf7eeb000, 0x000001d5)
 133                 self.assertEqual(desc['filename'][5],
 134                                  b"/lib/i386-linux-gnu/libc-2.27.so")
 135
 136                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][6],
 137                                             desc['page_size'],
 138                                             0xf7eeb000, 0xf7eec000, 0x000001d7)
 139                 self.assertEqual(desc['filename'][6],
 140                                  b"/lib/i386-linux-gnu/libc-2.27.so")
 141
 142                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][7],
 143                                             desc['page_size'],
 144                                             0xf7f39000, 0xf7f5f000, 0x00000000)
 145                 self.assertEqual(desc['filename'][7],
 146                                  b"/lib/i386-linux-gnu/ld-2.27.so")
 147
 148                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][8],
 149                                             desc['page_size'],
 150                                             0xf7f5f000, 0xf7f60000, 0x00000025)
 151                 self.assertEqual(desc['filename'][8],
 152                                  b"/lib/i386-linux-gnu/ld-2.27.so")
 153
 154                 self.validate_nt_file_entry(desc['Elf_Nt_File_Entry'][9],
 155                                             desc['page_size'],
 156                                             0xf7f60000, 0xf7f61000, 0x00000026)
 157                 self.assertEqual(desc['filename'][9],
 158                                  b"/lib/i386-linux-gnu/ld-2.27.so")
 159
 160         self.assertTrue(nt_file_found)
 161
 162     def validate_nt_file_entry(self,
 163                                entry,
 164                                page_size,
 165                                expected_vm_start,
 166                                expected_vm_end,
 167                                expected_page_offset):
 168         self.assertEqual(entry.vm_start, expected_vm_start)
 169         self.assertEqual(entry.vm_end, expected_vm_end)
 170         self.assertEqual(entry.page_offset, expected_page_offset)
 171
 172     @classmethod
 173     def tearDownClass(cls):
 174         cls._core_file.close()