StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>The only way that I was able to get this to work was to modify the core file itself to have an additional program header/section that contained the new data.</p> <p>In theory, I believe that objcopy should be able to do this, but after a lot of testing I was unable to get it to work. Instead, I resorted to writing a perl script that modified the core file.</p> <p>Here is the script for those of you stuck in a similar situation (note that this is for ELF core files on an i386 arch):</p> <pre>#!/usr/bin/perl my @elfHeader = ( [ident => 'A16'], [e_type => 'v'], [e_machine => 'v'], [e_version => 'V'], [e_entry => 'V'], [e_phoff => 'V'], [e_shoff => 'V'], [e_flags => 'V'], [e_ehsize => 'v'], [e_phentsize => 'v'], [e_phnum => 'v'], [e_shentsize => 'v'], [e_shnum => 'v'], [e_shstrndx => 'v'] ); my @progHeader = ( [ptype => 'V'], [poffset => 'V'], [pvaddr => 'V'], [ppaddr => 'V'], [pfilesz => 'V'], [pmemsz => 'V'], [pflags => 'V'], [palign => 'V'], ); my ($core, $dataFile, $outFile) = @ARGV; main(); sub main { my @stat = stat($core); my $coreSize = $stat[7]; @stat = stat($dataFile); my $dfSize = $stat[7]; my ($in, $out, $df); open($in, "", $outFile) || die("Couldn't open $outFile: $!"); my $buf; my $bytes = sysread($in, $buf, 52); my $hdr = unpackStruct(\@elfHeader, $buf); # Fix the elf header to have an additional program header my $phNum = $hdr->{e_phnum}; $hdr->{e_phnum}++; # Fix the header to point to a new location for the program headers (at the end of the file) my $phOff = $hdr->{e_phoff}; $hdr->{e_phoff} = $coreSize; # Read in the full program header table my $phTable; sysseek($in, $phOff, 0); my $readSize = $hdr->{e_phentsize} * $phNum; $bytes = sysread($in, $phTable, $readSize); # Add an additional entry to the end of the ph table my $entry = packStruct(\@progHeader, {ptype => 1, poffset => $coreSize + $hdr->{e_phentsize} * $hdr->{e_phnum}, pvaddr => 0x80f95000, ppaddr => 0, pfilesz => $dfSize, pmemsz => $dfSize, pflags => 7, palign => 4096}); $phTable .= $entry; # Form the new elf header my $elf = packStruct(\@elfHeader, $hdr); # Output the new header syswrite($out, $elf, length($elf)); # Copy the full core file after the header sysseek($in, 52, 0); copyData($in, $out, $coreSize - 52); # Output the new program table syswrite($out, $phTable, length($phTable)); # Add the data on the end copyData($df, $out, $dfSize); } sub copyData { my ($in, $out, $numBytes) = @_; my $buf; while ($numBytes > 0) { my $readBytes = sysread($in, $buf, 8192); syswrite($out, $buf, $readBytes); $numBytes -= $readBytes; } } sub unpackStruct { my ($fields, $data) = @_; my $unpack; map {$unpack .= $_->[1]} @{$fields}; my @vals = unpack($unpack, $data); my %res; foreach my $field (@{$fields}) { $res{$field->[0]} = shift(@vals); } return \%res; } sub packStruct { my ($fields, $data) = @_; my $pack; map {$pack .= $_->[1]} @{$fields}; my @vals; foreach my $field (@{$fields}) { push(@vals, $data->{$field->[0]}) } my $res = pack($pack, @vals); return $res; } </pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload