我正在尝试从没有调试信息的程序(Linux)中分析核心转储.分析应该在C中自动完成,所以没有GDB.

正如我在GDB中看到的那样,可以通过命令信息寄存器获得堆栈指针和堆栈基指针(ESP和EBP)的顶部.当我上下移动堆栈(命令上下)时,我会看到当前帧的寄存器的更新版本.

我的问题是,我在哪里可以在核心转储中找到这些信息？我知道核心转储中有一个包含NT_PRSTATUS,NT_PRPSINFO和NT_AUXV的NOTE部分.但遗憾的是,我无法找到有关该笔记的任何信息. GDB如何构建框架,从哪里获取信息？

解决方法:

首先,您需要阅读ELF规范,然后阅读linux / fs / binfmt_elf.c中的函数elf_core_dump(),以了解coredump文件的组织方式.但无论如何,您可以检查以下程序.

 #include <stdio.h>
 #include <elf.h>
 #include <sys/types.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <stdlib.h>
 #include <sys/procfs.h>

 int main (int argc, char **arg)
 {
Elf32_Ehdr *elfh;
Elf32_Shdr *elfsh;
Elf32_Phdr *elfphdr;
char *p = NULL;
char buf[1000], sbuf[1000];
int ret, fd, i = 0, size;

if (argc < 2) {
    printf("\nUsage: corenotes <core>\n");
    return 0;
}

fd = open(arg[1], O_RDONLY);
if (fd < 0) {
    perror("open");
    return 0;
}

/* Read ELF header*/
ret = read(fd, buf, sizeof(*elfh));
if (!ret) {
    perror("Error Reading the ELF Header");
    goto cl;
}
elfh = (Elf32_Ehdr *) buf;
/* Is it ELF*/
if ((elfh->e_ident[0] != 0x7f) || (elfh->e_ident[1] != 'E') ||
    (elfh->e_ident[2] != 'L') || (elfh->e_ident[3] != 'F')) {
    printf("\nUnrecongised File Format");
    goto cl;
}

/*
 * read program headers and print
 */
size = elfh->e_phnum * elfh->e_phentsize;
p =  malloc(size);

lseek(fd, elfh->e_phoff, SEEK_SET); 
ret = read(fd, p, size);
if (ret != size) {
    printf("\nCannot read Program Header");
    goto cl;
}
elfphdr = (Elf32_Phdr *)p;
for (i = 0; i < elfh->e_phnum; i++) {
    if (elfphdr->p_type == PT_NOTE) {
        unsigned char *pdata;
        struct note {
            unsigned int namesz;
            unsigned int descsz;
            unsigned int type;
        };
        struct note *not;
        int pad;

        pdata = malloc(elfphdr->p_filesz);
        lseek(fd, elfphdr->p_offset, SEEK_SET);
        ret = read(fd, pdata, elfphdr->p_filesz);
        not = (struct note *) pdata;
        printf("\n%s", pdata + sizeof (*not));
        pad  = 4 - (not->namesz % 4); 
        if (not->type == NT_PRSTATUS) {
            struct elf_prstatus *prs;

            prs = (struct elf_prstatus *)(pdata + sizeof(*not) + not->namesz + pad);
            printf("\nProgram Received %d", prs->pr_cursig);
            printf("\nPending Signals %08x", prs->pr_sigpend);
            printf("\nHold Signals %08x", prs->pr_sighold);
            printf("\nPID of the process %d", prs->pr_pid);
            printf("\nPPID of the process %d", prs->pr_ppid);
            printf("\nEBX: %08x", prs->pr_reg[0]);
            printf("\nECX: %08x", prs->pr_reg[1]);
            printf("\nEDX: %08x", prs->pr_reg[2]);
            printf("\nESI: %08x", prs->pr_reg[3]);
            printf("\nEDI: %08x", prs->pr_reg[4]);
            printf("\nEBP: %08x", prs->pr_reg[5]);
            printf("\nEAX: %08x", prs->pr_reg[6]);
            printf("\nXDS: %08x", prs->pr_reg[7]);
            printf("\nXES: %08x", prs->pr_reg[8]);
            printf("\nXFS: %08x", prs->pr_reg[9]);
            printf("\nXGS: %08x", prs->pr_reg[10]);
            printf("\nORG_EAX: %08x", prs->pr_reg[11]);
            printf("\nEIP: %08x", prs->pr_reg[12]);
            printf("\nECS: %08x", prs->pr_reg[13]);
            printf("\nEFLAGS: %08x", prs->pr_reg[14]);
            printf("\nESP: %08x", prs->pr_reg[15]);
            printf("\nXSS: %08x", prs->pr_reg[16]);
            pdata = pdata + sizeof(*not) + not->namesz + pad + sizeof(struct elf_prstatus);
        }
         not = (struct note *)pdata;
         if (not->type == NT_PRPSINFO) {
            struct elf_prpsinfo *prs;
            printf("\n\nNT_PRPSINF\n");
            pad  = 4 - (not->namesz % 4);
            prs = (struct elf_prpsinfo *)(pdata + sizeof(*not) + not->namesz + pad);
            printf("\nName of the Exe %s", prs->pr_fname);
        }
    //  free(pdata);
    }
    elfphdr++;
}
  free(p);      
  printf("\n\n");
  cl:   
  close(fd);
  return 0;
}