Skip to content

Failing to parse QEMU memory dump note .shstrtab #370

@IridiumXOR

Description

@IridiumXOR

Hi,
if you generate an ELF core file containing the memory dump of VM in QEMU (qemu-system-x86_64 than in console dump-guest-memory FILENAME) and you parse it with a simple Rust program as

use goblin::Object;
use std::io::Read;
use std::fs::File;

fn main() {

    let mut file = File::open("/tmp/elf").map_err(|_| "open file error").expect("Error");

    let mut head = vec![0; 1024*1024*2];
    file.read(&mut head).ok();
    println!("{:?}\n", Object::parse(&head));
}

you get Err(Malformed("Section 1 size (151127112) + offset (11) is out of bounds. Overflowed: false")) but the ELF core is correctly formatted. I suppose the error is a offset-by-one error.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions