-
Notifications
You must be signed in to change notification settings - Fork 172
Open
Description
Hi,
if you generate an ELF core file containing the memory dump of VM in QEMU (qemu-system-x86_64
than in console dump-guest-memory FILENAME
) and you parse it with a simple Rust program as
use goblin::Object;
use std::io::Read;
use std::fs::File;
fn main() {
let mut file = File::open("/tmp/elf").map_err(|_| "open file error").expect("Error");
let mut head = vec![0; 1024*1024*2];
file.read(&mut head).ok();
println!("{:?}\n", Object::parse(&head));
}
you get Err(Malformed("Section 1 size (151127112) + offset (11) is out of bounds. Overflowed: false"))
but the ELF core is correctly formatted. I suppose the error is a offset-by-one error.
Metadata
Metadata
Assignees
Labels
No labels