560 lines
21 KiB
Text
560 lines
21 KiB
Text
NAME=mdmp open
|
|
FILE=bins/mdmp/calc.dmp
|
|
CMDS=i~format
|
|
EXPECT=<<EOF
|
|
format mdmp
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp info
|
|
FILE=bins/mdmp/calc.dmp
|
|
CMDS=iI
|
|
EXPECT=<<EOF
|
|
arch x86
|
|
cpu N/A
|
|
baddr ----------
|
|
binsz 0x00008f74
|
|
bintype mdmp
|
|
bits 64
|
|
retguard false
|
|
class N/A
|
|
compiler N/A
|
|
dbg_file N/A
|
|
endian LE
|
|
flags 0x00040000
|
|
hdr.csum 0x00000000
|
|
guid N/A
|
|
intrp N/A
|
|
laddr 0x00000000
|
|
lang N/A
|
|
machine AMD64
|
|
maxopsz 16
|
|
minopsz 1
|
|
os Windows NT Workstation 6.1.7601
|
|
cc N/A
|
|
pcalign 0
|
|
rpath NONE
|
|
streams 13
|
|
subsys
|
|
stripped false
|
|
crypto false
|
|
havecode true
|
|
va true
|
|
sanitiz false
|
|
static true
|
|
linenum false
|
|
lsyms false
|
|
canary false
|
|
PIE false
|
|
RELROCS false
|
|
NX false
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp sections
|
|
FILE=bins/mdmp/calc.dmp
|
|
CMDS=iS
|
|
EXPECT=<<EOF
|
|
paddr size vaddr vsize align perm name type flags
|
|
-------------------------------------------------------------------------------------------------------
|
|
0x00000000 0xe3000 0xfffe0000 0xe3000 0x0 ---- C:_Windows_System32_calc.exe
|
|
0x00000000 0x1aa000 0x77720000 0x1aa000 0x0 ---- C:_Windows_System32__tdll.dll
|
|
0x00000000 0x11f000 0x77500000 0x11f000 0x0 ---- C:_Windows_System32_kernel32.dll
|
|
0x00000000 0x6a000 0x7fefd4a0000 0x6a000 0x0 ---- C:_Windows_System32_KERNELBASE.dll
|
|
0x00000000 0xd8a000 0x7fefeca0000 0xd8a000 0x0 ---- C:_Windows_System32_shell32.dll
|
|
0x00000000 0x9f000 0x7fefdab0000 0x9f000 0x0 ---- C:_Windows_System32_msvcrt.dll
|
|
0x00000000 0x71000 0x7fefd890000 0x71000 0x0 ---- C:_Windows_System32_shlwapi.dll
|
|
0x00000000 0x67000 0x7fefdb50000 0x67000 0x0 ---- C:_Windows_System32_gdi32.dll
|
|
0x00000000 0xfa000 0x77620000 0xfa000 0x0 ---- C:_Windows_System32_user32.dll
|
|
0x00000000 0xe000 0x7fefdbc0000 0xe000 0x0 ---- C:_Windows_System32_lpk.dll
|
|
0x00000000 0xca000 0x7fefe450000 0xca000 0x0 ---- C:_Windows_System32_usp10.dll
|
|
0x00000000 0x203000 0x7fefea90000 0x203000 0x0 ---- C:_Windows_System32_ole32.dll
|
|
0x00000000 0x12d000 0x7fefe8d0000 0x12d000 0x0 ---- C:_Windows_System32__pcrt4.dll
|
|
0x00000000 0xdb000 0x7fefd9d0000 0xdb000 0x0 ---- C:_Windows_System32__dvapi32.dll
|
|
0x00000000 0x1f000 0x7fefdff0000 0x1f000 0x0 ---- C:_Windows_System32_sechost.dll
|
|
0x00000000 0xda000 0x7fefe520000 0xda000 0x0 ---- C:_Windows_System32_oleaut32.dll
|
|
0x00000000 0x56000 0x7fefbb40000 0x56000 0x0 ---- C:_Windows_System32_uxtheme.dll
|
|
0x00000000 0x3b000 0x7fefa140000 0x3b000 0x0 ---- C:_Windows_System32_winmm.dll
|
|
0x00000000 0xc000 0x7fefc330000 0xc000 0x0 ---- C:_Windows_System32__ersion.dll
|
|
0x00000000 0x2e000 0x7fefea00000 0x2e000 0x0 ---- C:_Windows_System32_imm32.dll
|
|
0x00000000 0x109000 0x7fefe340000 0x109000 0x0 ---- C:_Windows_System32_msctf.dll
|
|
0x00000000 0x161000 0x7fefb560000 0x161000 0x0 ---- C:_Windows_System32_WindowsCodecs.dll
|
|
0x00000000 0x18000 0x7fefb710000 0x18000 0x0 ---- C:_Windows_System32_dwmapi.dll
|
|
0x00000000 0xf000 0x7fefd2b0000 0xf000 0x0 ---- C:_Windows_System32_CRYPTBASE.dll
|
|
0x00000000 0x99000 0x7fefddb0000 0x99000 0x0 ---- C:_Windows_System32_clbcatq.dll
|
|
0x00000000 0x54000 0x7fef62b0000 0x54000 0x0 ---- C:_Windows_System32_oleacc.dll
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp maps
|
|
FILE=bins/mdmp/calc.dmp
|
|
CMDS=oml
|
|
EXPECT=<<EOF
|
|
1 fd: 3 +0x000043ac 0x0398f9b8 - 0x0398ffff r-- fmap.memory.0x398f9b8
|
|
2 fd: 3 +0x000049f4 0x77639dea - 0x77639ee9 r-- fmap.memory.0x77639dea
|
|
3 fd: 3 +0x00004af4 0x032cf638 - 0x032cffff r-- fmap.memory.0x32cf638
|
|
4 fd: 3 +0x000054bc 0x0367f868 - 0x0367ffff r-- fmap.memory.0x367f868
|
|
5 fd: 3 +0x00005c54 0x000bd0d8 - 0x000bffff r-- fmap.memory.0xbd0d8
|
|
6 fd: 3 +0x00008b7c 0x03a7ff08 - 0x03a7ffff r-- fmap.memory.0x3a7ff08
|
|
7 fd: 3 +0x00008c74 0x7776ad90 - 0x7776ae8f r-- fmap.memory.0x7776ad90
|
|
8 fd: 3 +0x00008d74 0x7776bafa - 0x7776bbf9 r-- fmap.memory.0x7776bafa
|
|
9 fd: 3 +0x00008e74 0x7776c06a - 0x7776c169 r-- fmap.memory.0x7776c06a
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp memory64 maps
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=oml
|
|
EXPECT=<<EOF
|
|
1 fd: 3 +0x00002c8f 0x00010000 - 0x0001ffff r-- fmap.memory64.0x10000
|
|
2 fd: 3 +0x00012c8f 0x00020000 - 0x0002ffff r-- fmap.memory64.0x20000
|
|
3 fd: 3 +0x00022c8f 0x0022d000 - 0x0022ffff r-- fmap.memory64.0x22d000
|
|
4 fd: 3 +0x00025c8f 0x00230000 - 0x00233fff r-- fmap.memory64.0x230000
|
|
5 fd: 3 +0x00029c8f 0x00240000 - 0x00240fff r-- fmap.memory64.0x240000
|
|
6 fd: 3 +0x0002ac8f 0x00250000 - 0x00250fff r-- fmap.memory64.0x250000
|
|
7 fd: 3 +0x0002bc8f 0x00260000 - 0x002c6fff r-- fmap.memory64.0x260000
|
|
8 fd: 3 +0x00092c8f 0x00400000 - 0x00400fff r-- fmap.memory64.0x400000
|
|
9 fd: 3 +0x00093c8f 0x00401000 * 0x00402fff r-x fmap.memory64.0x401000
|
|
10 fd: 3 +0x00095c8f 0x00403000 - 0x00403fff r-- fmap.memory64.0x403000
|
|
11 fd: 3 +0x00096c8f 0x00404000 - 0x00406fff r-- fmap.memory64.0x404000
|
|
12 fd: 3 +0x00099c8f 0x00407000 - 0x00408fff r-- fmap.memory64.0x407000
|
|
13 fd: 3 +0x0009bc8f 0x00409000 - 0x0040bfff --- fmap.memory64.0x409000
|
|
14 fd: 3 +0x0009ec8f 0x0040c000 - 0x00424fff r-- fmap.memory64.0x40c000
|
|
15 fd: 3 +0x000b7c8f 0x00580000 - 0x00584fff r-- fmap.memory64.0x580000
|
|
16 fd: 3 +0x000bcc8f 0x005e0000 - 0x005e6fff r-- fmap.memory64.0x5e0000
|
|
17 fd: 3 +0x000c3c8f 0x77500000 - 0x77500fff r-- fmap.memory64.0x77500000
|
|
18 fd: 3 +0x000c4c8f 0x77501000 - 0x7759bfff r-x fmap.memory64.0x77501000
|
|
19 fd: 3 +0x0015fc8f 0x7759c000 - 0x77609fff r-- fmap.memory64.0x7759c000
|
|
20 fd: 3 +0x001cdc8f 0x7760a000 - 0x7760bfff r-- fmap.memory64.0x7760a000
|
|
21 fd: 3 +0x001cfc8f 0x7760c000 - 0x7761efff r-- fmap.memory64.0x7760c000
|
|
22 fd: 3 +0x001e2c8f 0x77720000 - 0x77720fff r-- fmap.memory64.0x77720000
|
|
23 fd: 3 +0x001e3c8f 0x77721000 - 0x7781dfff r-x fmap.memory64.0x77721000
|
|
24 fd: 3 +0x002e0c8f 0x7781e000 - 0x7784cfff r-- fmap.memory64.0x7781e000
|
|
25 fd: 3 +0x0030fc8f 0x7784d000 - 0x7784dfff r-- fmap.memory64.0x7784d000
|
|
26 fd: 3 +0x00310c8f 0x7784e000 - 0x7784efff --- fmap.memory64.0x7784e000
|
|
27 fd: 3 +0x00311c8f 0x7784f000 - 0x7784ffff r-- fmap.memory64.0x7784f000
|
|
28 fd: 3 +0x00312c8f 0x77850000 - 0x77851fff --- fmap.memory64.0x77850000
|
|
29 fd: 3 +0x00314c8f 0x77852000 - 0x77852fff r-- fmap.memory64.0x77852000
|
|
30 fd: 3 +0x00315c8f 0x77853000 - 0x77855fff --- fmap.memory64.0x77853000
|
|
31 fd: 3 +0x00318c8f 0x77856000 - 0x77857fff r-- fmap.memory64.0x77856000
|
|
32 fd: 3 +0x0031ac8f 0x77858000 - 0x77858fff --- fmap.memory64.0x77858000
|
|
33 fd: 3 +0x0031bc8f 0x77859000 - 0x7785afff r-- fmap.memory64.0x77859000
|
|
34 fd: 3 +0x0031dc8f 0x7785b000 - 0x778c9fff r-- fmap.memory64.0x7785b000
|
|
35 fd: 3 +0x0038cc8f 0x7efe0000 - 0x7efe4fff r-- fmap.memory64.0x7efe0000
|
|
36 fd: 3 +0x00391c8f 0x7ffe0000 - 0x7ffe0fff r-- fmap.memory64.0x7ffe0000
|
|
37 fd: 3 +0x00392c8f 0x7fefd4a0000 - 0x7fefd4a0fff r-- fmap.memory64.0x7fefd4a0000
|
|
38 fd: 3 +0x00393c8f 0x7fefd4a1000 - 0x7fefd4e9fff r-x fmap.memory64.0x7fefd4a1000
|
|
39 fd: 3 +0x003dcc8f 0x7fefd4ea000 - 0x7fefd4fefff r-- fmap.memory64.0x7fefd4ea000
|
|
40 fd: 3 +0x003f1c8f 0x7fefd4ff000 - 0x7fefd500fff r-- fmap.memory64.0x7fefd4ff000
|
|
41 fd: 3 +0x003f3c8f 0x7fefd501000 - 0x7fefd509fff r-- fmap.memory64.0x7fefd501000
|
|
42 fd: 3 +0x003fcc8f 0x7fefdab0000 - 0x7fefdab0fff r-- fmap.memory64.0x7fefdab0000
|
|
43 fd: 3 +0x003fdc8f 0x7fefdab1000 - 0x7fefdb29fff r-x fmap.memory64.0x7fefdab1000
|
|
44 fd: 3 +0x00476c8f 0x7fefdb2a000 - 0x7fefdb40fff r-- fmap.memory64.0x7fefdb2a000
|
|
45 fd: 3 +0x0048dc8f 0x7fefdb41000 - 0x7fefdb42fff r-- fmap.memory64.0x7fefdb41000
|
|
46 fd: 3 +0x0048fc8f 0x7fefdb43000 - 0x7fefdb43fff --- fmap.memory64.0x7fefdb43000
|
|
47 fd: 3 +0x00490c8f 0x7fefdb44000 - 0x7fefdb44fff r-- fmap.memory64.0x7fefdb44000
|
|
48 fd: 3 +0x00491c8f 0x7fefdb45000 - 0x7fefdb46fff --- fmap.memory64.0x7fefdb45000
|
|
49 fd: 3 +0x00493c8f 0x7fefdb47000 - 0x7fefdb4efff r-- fmap.memory64.0x7fefdb47000
|
|
50 fd: 3 +0x0049bc8f 0x7feffa40000 - 0x7feffa40fff r-- fmap.memory64.0x7feffa40000
|
|
51 fd: 3 +0x0049cc8f 0x7fffffb0000 - 0x7fffffd2fff r-- fmap.memory64.0x7fffffb0000
|
|
52 fd: 3 +0x004bfc8f 0x7fffffd7000 - 0x7fffffd7fff r-- fmap.memory64.0x7fffffd7000
|
|
53 fd: 3 +0x004c0c8f 0x7fffffde000 - 0x7fffffdffff r-- fmap.memory64.0x7fffffde000
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp entrypoints nomem .dmp
|
|
FILE=bins/mdmp/calc.dmp
|
|
CMDS=ie
|
|
EXPECT=<<EOF
|
|
vaddr paddr hvaddr haddr type
|
|
------------------------------
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp resolve vaddr to paddr
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=px 64 @ 0x00400000
|
|
EXPECT=<<EOF
|
|
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
|
|
0x00400000 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
|
|
0x00400010 b800 0000 0000 0000 4000 0000 0000 0000 ........@.......
|
|
0x00400020 0000 0000 0000 0000 0000 0000 0000 0000 ................
|
|
0x00400030 0000 0000 0000 0000 0000 0000 8000 0000 ................
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp test format definitions
|
|
FILE=bins/mdmp/hello.dmp
|
|
ARGS=-nn
|
|
CMDS=pfn~mdmp
|
|
EXPECT=<<EOF
|
|
mdmp_memory_info "qq[4]Edq[4]E[4]E[4]Ed BaseAddress AllocationBase (mdmp_page_protect)AllocationProtect __Alignment1 RegionSize (mdmp_mem_state)State (mdmp_page_protect)Protect (mdmp_mem_type)Type __Alignment2"
|
|
mdmp_exception "[4]E[4]Eqqdd[15]q (mdmp_exception_code)ExceptionCode (mdmp_exception_flags)ExceptionFlags ExceptionRecord ExceptionAddress NumberParameters __UnusedAlignment ExceptionInformation"
|
|
mdmp_misc_info "d[4]Bdtttddddd SizeOfInfo (mdmp_misc1_flags)Flags1 ProcessId ProcessCreateTime ProcessUserTime ProcessKernelTime ProcessorMaxMhz ProcessorCurrentMhz ProcessorMhzLimit ProcessorMaxIdleState ProcessorCurrentIdleState"
|
|
mdmp_module "qddtd???qq BaseOfImage SizeOfImage CheckSum TimeDateStamp ModuleNameRVA (mdmp_vs_fixedfileinfo)VersionInfo (mdmp_location_descriptor)CvRecord (mdmp_location_descriptor)MiscRecord Reserved0 Reserved1"
|
|
mdmp_module_list "d[10]? NumberOfModule (mdmp_module)Modules"
|
|
mdmp_system_info "[2]EwwbBddd[4]Ed[2]Ew[2]q (mdmp_processor_architecture)ProcessorArchitecture ProcessorLevel ProcessorRevision NumberOfProcessors (mdmp_product_type)ProductType MajorVersion MinorVersion BuildNumber (mdmp_platform_id)PlatformId CsdVersionRva (mdmp_suite_mask)SuiteMask Reserved2 ProcessorFeatures"
|
|
mdmp_location_descriptor "dd DataSize RVA"
|
|
mdmp_token_info "ddq TokenSize TokenId TokenHandle"
|
|
mdmp_thread_list "d[1]? NumberOfThreads (mdmp_thread)Threads"
|
|
mdmp_vs_fixedfileinfo "ddddddddddddd dwSignature dwStrucVersion dwFileVersionMs dwFileVersionLs dwProductVersionMs dwProductVersionLs dwFileFlagsMask dwFileFlags dwFileOs dwFileType dwFileSubtype dwFileDateMs dwFileDateLs"
|
|
mdmp_memory_descriptor "q? StartOfMemoryRange (mdmp_location_descriptor)Memory"
|
|
mdmp_memory_descriptor64 "qq StartOfMemoryRange DataSize"
|
|
mdmp_string "dZ Length Buffer"
|
|
mdmp_memory_info_list "ddq[127]? SizeOfHeader SizeOfEntry NumberOfEntries (mdmp_memory_info)MemoryInfo"
|
|
mdmp_thread "ddddq?? ThreadId SuspendCount PriorityClass Priority Teb (mdmp_memory_descriptor)Stack (mdmp_location_descriptor)ThreadContext"
|
|
mdmp_token_info_list "dddd TokenListSize TokenListEntries ListHeaderSize ElementHeaderSize"
|
|
mdmp_location_descriptor64 "qq DataSize RVA"
|
|
mdmp_directory "[4]E? (mdmp_stream_type)StreamType (mdmp_location_descriptor)Location"
|
|
mdmp_header "[4]zddddt[8]B Signature Version NumberOfStreams StreamDirectoryRVA CheckSum TimeDateStamp (mdmp_type)Flags"
|
|
mdmp_memory64_list "qq[83]? NumberOfMemoryRanges BaseRva (mdmp_memory_descriptor64)MemoryRanges"
|
|
mdmp_exception_stream "dd?? ThreadId __Alignment (mdmp_exception)ExceptionRecord (mdmp_location_descriptor)ThreadContext"
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - libraries count
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=il:quiet~?
|
|
EXPECT=<<EOF
|
|
57
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - libraries resolving
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=il~kernel32.dll
|
|
EXPECT=<<EOF
|
|
[0x00400000] - kernel32.dll
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - entrypoints count
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=<<EOF
|
|
ie:quiet~?
|
|
iee:quiet~?
|
|
EOF
|
|
EXPECT=<<EOF
|
|
9
|
|
2
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - entrypoints resolving
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=ie~0x004014e0
|
|
EXPECT=<<EOF
|
|
0x004014e0 0x000990b2 ---------- 0x00097c7a program
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - symbols count
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=is~?
|
|
EXPECT=<<EOF
|
|
7468
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - symbols resolving 1
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=is~DeleteCriticalSection:0
|
|
EXPECT=<<EOF
|
|
1 0x0009dcda 0x00406108 NONE FUNC 0 KERNEL32.dll imp.DeleteCriticalSection
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - symbols resolving 2
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=is~RtlDeleteCriticalSection:0
|
|
EXPECT=<<EOF
|
|
358 0x001c2176 0x76fb05a4 NONE FUNC 0 ntdll.dll imp.RtlDeleteCriticalSection
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - imports count
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=ii~?
|
|
EXPECT=<<EOF
|
|
2030
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - imports resolving
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=ii~TerminateProcess~KERNEL32.dll
|
|
EXPECT=<<EOF
|
|
17 0x00406148 NONE FUNC KERNEL32.dll TerminateProcess
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - exports count
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=iE~?
|
|
EXPECT=<<EOF
|
|
5440
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - exports resolving
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=iE~Ordinal_1
|
|
EXPECT=<<EOF
|
|
1 0x0041f1f2 0x77802620 GLOBAL FUNC 0 ntdll.dll Ordinal_1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - relocs count
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=ir:quiet~?
|
|
EXPECT=<<EOF
|
|
2028
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - relocs resolving
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=ir~__dllonexit
|
|
EXPECT=<<EOF
|
|
0x00406160 0x0009dd32 SET_32 msvcrt.dll___dllonexit
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - relocs following
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=e asm.bytes=true;pd 12 @ [0x004061cc];
|
|
EXPECT=<<EOF
|
|
;-- vfprintf:
|
|
0x773e7430 8bff mov edi, edi
|
|
0x773e7432 55 push rbp
|
|
0x773e7433 8bec mov ebp, esp
|
|
0x773e7435 ff7510 push qword [rbp + 0x10]
|
|
0x773e7438 6a00 push 0
|
|
0x773e743a ff750c push qword [rbp + 0xc]
|
|
0x773e743d ff7508 push qword [rbp + 8]
|
|
0x773e7440 68fdcc3777 push 0x7737ccfd
|
|
0x773e7445 e800feffff call 0x773e724a
|
|
0x773e744a 83c414 add esp, 0x14
|
|
0x773e744d 5d pop rbp
|
|
0x773e744e c3 ret
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 32bit - strings
|
|
FILE=bins/mdmp/hello.dmp
|
|
CMDS=<<EOF
|
|
iz~0x0043cf24[1,2,3,4,5,6,7,8]
|
|
iz~0x0043cf2e[1,2,3,4,5,6,7,8]
|
|
iz~0x0043cf38[1,2,3,4,5,6,7,8]
|
|
iz~0x00447247[1,2,3,4,5,6,7,8]
|
|
iz~0x0044726b[1,2,3,4,5,6,7,8]
|
|
iz~0x00447291[1,2,3,4,5,6,7,8]
|
|
iz~0x004472ac[1,2,3,4,5,6,7,8]
|
|
iz~0x0048acc8[1,2,3,4,5,6,7,8]
|
|
iz~0x0048b004[1,2,3,4,5,6,7,8]
|
|
iz~0x00168c38[1,2,3,4,5,6,7,8]
|
|
iz~0x00168f80[1,2,3,4,5,6,7,8]
|
|
iz~0x00128c38[1,2,3,4,5,6,7,8]
|
|
iz~0x00128fa8[1,2,3,4,5,6,7,8]
|
|
iz~0x000cdc38[1,2,3,4,5,6,7,8]
|
|
iz~0x000cdf84[1,2,3,4,5,6,7,8]
|
|
iz~0x00299106[1,2,3,4,5,6,7,8]
|
|
iz~0x001adff0[1,2,3,4,5,6,7,8]
|
|
iz~0x0033641a[1,2,3,4,5,6,7,8]
|
|
iz~0x00337f88[1,2,3,4,5,6,7,8]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0043cf24 0x77820352 4 10 C:_Windows_System32__tdll.dll utf16le Alpc
|
|
0x0043cf2e 0x7782035c 4 10 C:_Windows_System32__tdll.dll utf16le Pool
|
|
0x0043cf38 0x77820366 5 12 C:_Windows_System32__tdll.dll utf16le Timer
|
|
0x00447247 0x7782a675 35 36 C:_Windows_System32__tdll.dll ascii RtlFindActivationContextSectionGuid
|
|
0x0044726b 0x7782a699 37 38 C:_Windows_System32__tdll.dll ascii RtlFindActivationContextSectionString
|
|
0x00447291 0x7782a6bf 26 27 C:_Windows_System32__tdll.dll ascii RtlFindCharInUnicodeString
|
|
0x004472ac 0x7782a6da 16 17 C:_Windows_System32__tdll.dll ascii RtlFindClearBits
|
|
0x0048acc8 0x7786e0f6 15 32 C:_Windows_System32__tdll.dll utf16le VS_VERSION_INFO
|
|
0x0048b004 0x7786e432 11 24 C:_Windows_System32__tdll.dll utf16le VarFileInfo
|
|
0x00168c38 0x7500d066 15 32 C:_Windows_System32_wow64.dll utf16le VS_VERSION_INFO
|
|
0x00168f80 0x7500d3ae 11 24 C:_Windows_System32_wow64.dll utf16le VarFileInfo
|
|
0x00128c38 0x74fc9066 15 32 C:_Windows_System32_wow64win.dll utf16le VS_VERSION_INFO
|
|
0x00128fa8 0x74fc93d6 11 24 C:_Windows_System32_wow64win.dll utf16le VarFileInfo
|
|
0x000cdc38 0x74f66066 15 32 C:_Windows_System32_wow64cpu.dll utf16le VS_VERSION_INFO
|
|
0x000cdf84 0x74f663b2 11 24 C:_Windows_System32_wow64cpu.dll utf16le VarFileInfo
|
|
0x00299106 0x77378534 11 12 C:_Windows_SysWOW64_kernel32.dll ascii _vfprintf_l
|
|
0x001adff0 0x75d9341e 11 24 C:_Windows_SysWOW64_KERNELBASE.dll utf16le VarFileInfo
|
|
0x0033641a 0x77415848 39 40 C:_Windows_SysWOW64_msvcrt.dll ascii Assertion failed:
|
|
0x00337f88 0x774173b6 11 24 C:_Windows_SysWOW64_msvcrt.dll utf16le VarFileInfo
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - libraries count
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=il:quiet~?
|
|
EXPECT=<<EOF
|
|
49
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - libraries resolving
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=il~kernel32.dll
|
|
EXPECT=<<EOF
|
|
[0x00400000] - kernel32.dll
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - entrypoints count
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=ie:quiet~?
|
|
EXPECT=<<EOF
|
|
5
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - entrypoints resolving
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=ie~0x00401500
|
|
EXPECT=<<EOF
|
|
0x00401500 0x0009418f ---------- 0x00092d37 program
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - symbols count
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=is~?
|
|
EXPECT=<<EOF
|
|
6826
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - symbols resolving 1
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=is~imp.DeleteCriticalSection~KERNEL32.dll
|
|
EXPECT=<<EOF
|
|
1 0x0009ae8b 0x004081fc NONE FUNC 0 KERNEL32.dll imp.DeleteCriticalSection
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - symbols resolving 2
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=is~A_SHAFinal
|
|
EXPECT=<<EOF
|
|
9 0x001eb87f 0x77728bf0 GLOBAL FUNC 0 ntdll.dll A_SHAFinal
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - imports count
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=ii~?
|
|
EXPECT=<<EOF
|
|
1511
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - imports resolving
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=ii~KERNEL32.dll~GetCurrentProcessId
|
|
EXPECT=<<EOF
|
|
4 0x00408214 NONE FUNC KERNEL32.dll GetCurrentProcessId
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - exports count
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=iE~?
|
|
EXPECT=<<EOF
|
|
5317
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - exports resolving
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=iE~CsrVerifyRegion
|
|
EXPECT=<<EOF
|
|
39 0x0029513f 0x777d24b0 GLOBAL FUNC 0 ntdll.dll CsrVerifyRegion
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - relocs count
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=ir:quiet~?
|
|
EXPECT=<<EOF
|
|
1509
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - relocs resolving
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=ir~KERNEL32.dll_DeleteCriticalSection
|
|
EXPECT=<<EOF
|
|
0x004081fc 0x0009ae8b SET_64 KERNEL32.dll_DeleteCriticalSection
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - relocs following
|
|
FILE=bins/mdmp/hello64.dmp
|
|
CMDS=e asm.bytes=true; pd 9 @ [0x004083ac];
|
|
EXPECT=<<EOF
|
|
;-- vfprintf:
|
|
0x7fefdb0a1a4 4883ec38 sub rsp, 0x38
|
|
0x7fefdb0a1a8 4c89442420 mov qword [rsp + 0x20], r8
|
|
0x7fefdb0a1ad 4c8bc2 mov r8, rdx
|
|
0x7fefdb0a1b0 488bd1 mov rdx, rcx
|
|
0x7fefdb0a1b3 488d0dea7ffa. lea rcx, [0x7fefdab21a4]
|
|
0x7fefdb0a1ba 4533c9 xor r9d, r9d
|
|
0x7fefdb0a1bd e87efdffff call 0x7fefdb09f40
|
|
0x7fefdb0a1c2 4883c438 add rsp, 0x38
|
|
0x7fefdb0a1c6 c3 ret
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp 64bit - strings
|
|
FILE=bins/mdmp/hello64.dmp
|
|
TIMEOUT=2040
|
|
CMDS=<<EOF
|
|
iz~0x002e2fe1[1,2,3,4,5,6,7,8]
|
|
iz~0x002e2feb[1,2,3,4,5,6,7,8]
|
|
iz~0x002e2ff5[1,2,3,4,5,6,7,8]
|
|
iz~0x00330d85[1,2,3,4,5,6,7,8]
|
|
iz~0x003310c1[1,2,3,4,5,6,7,8]
|
|
iz~0x00161a37[1,2,3,4,5,6,7,8]
|
|
iz~0x00161c7f[1,2,3,4,5,6,7,8]
|
|
iz~0x00161dbf[1,2,3,4,5,6,7,8]
|
|
iz~0x001d9d45[1,2,3,4,5,6,7,8]
|
|
iz~0x001da0a5[1,2,3,4,5,6,7,8]
|
|
iz~0x003fad45[1,2,3,4,5,6,7,8]
|
|
iz~0x003fb0ad[1,2,3,4,5,6,7,8]
|
|
iz~0x00480857[1,2,3,4,5,6,7,8]
|
|
iz~0x004808c7[1,2,3,4,5,6,7,8]
|
|
iz~0x00499cf5[1,2,3,4,5,6,7,8]
|
|
iz~0x0049a045[1,2,3,4,5,6,7,8]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x002e2fe1 0x77820352 4 10 C:_Windows_System32__tdll.dll utf16le Alpc
|
|
0x002e2feb 0x7782035c 4 10 C:_Windows_System32__tdll.dll utf16le Pool
|
|
0x002e2ff5 0x77820366 5 12 C:_Windows_System32__tdll.dll utf16le Timer
|
|
0x00330d85 0x7786e0f6 15 32 C:_Windows_System32__tdll.dll utf16le VS_VERSION_INFO
|
|
0x003310c1 0x7786e432 11 24 C:_Windows_System32__tdll.dll utf16le VarFileInfo
|
|
0x00161a37 0x7759dda8 7 16 C:_Windows_System32_kernel32.dll utf16le win.ini
|
|
0x00161c7f 0x7759dff0 20 42 C:_Windows_System32_kernel32.dll utf16le \Classes\Wow6432Node
|
|
0x00161dbf 0x7759e130 45 92 C:_Windows_System32_kernel32.dll utf16le \REGISTRY\USER\*\SOFTWARE\Classes\Wow6432Node
|
|
0x001d9d45 0x776160b6 15 32 C:_Windows_System32_kernel32.dll utf16le VS_VERSION_INFO
|
|
0x001da0a5 0x77616416 11 24 C:_Windows_System32_kernel32.dll utf16le VarFileInfo
|
|
0x003fad45 0x7fefd5080b6 15 32 C:_Windows_System32_KERNELBASE.dll utf16le VS_VERSION_INFO
|
|
0x003fb0ad 0x7fefd50841e 11 24 C:_Windows_System32_KERNELBASE.dll utf16le VarFileInfo
|
|
0x00480857 0x7fefdb33bc8 4 10 C:_Windows_System32_msvcrt.dll utf16le PATH
|
|
0x004808c7 0x7fefdb33c38 10 22 C:_Windows_System32_msvcrt.dll utf16le SystemRoot
|
|
0x00499cf5 0x7fefdb4d066 15 32 C:_Windows_System32_msvcrt.dll utf16le VS_VERSION_INFO
|
|
0x0049a045 0x7fefdb4d3b6 11 24 C:_Windows_System32_msvcrt.dll utf16le VarFileInfo
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mdmp reload file
|
|
FILE=bins/mdmp/calc.dmp
|
|
CMDS=<<EOF
|
|
obR
|
|
echo ok
|
|
EOF
|
|
EXPECT=<<EOF
|
|
ok
|
|
EOF
|
|
RUN
|