arion::ElfCoredumpParser Class Reference

Helper class responsible for parsing the specific NOTE sections of an ELF core dump file. More...

#include <elf_parser.hpp>

Public Member Functions
	ElfCoredumpParser (std::weak_ptr< Arion > arion)
std::unique_ptr< LIEF::ELF::Binary >	parse_coredump_data (std::unique_ptr< LIEF::ELF::Binary > elf, std::shared_ptr< ELF_PARSER_ATTRIBUTES > attrs, std::vector< std::shared_ptr< struct SEGMENT > > segments)

Private Member Functions
void	parse_file_note (const LIEF::ELF::Note &note, std::vector< std::shared_ptr< struct SEGMENT > > segments)
void	parse_prstatus_note (const LIEF::ELF::Note &note, std::shared_ptr< ELF_PARSER_ATTRIBUTES > attrs)
void	parse_prpsinfo_note (const LIEF::ELF::Note &note, std::shared_ptr< ELF_PARSER_ATTRIBUTES > attrs)
void	parse_fpregset_note (const LIEF::ELF::Note &note, std::shared_ptr< ELF_PARSER_ATTRIBUTES > attrs)

Private Attributes
std::weak_ptr< Arion >	arion
	Weak pointer back to the main Arion instance.
std::shared_ptr< ELF_PARSER_ATTRIBUTES >	attrs
	Shared pointer to the parser attributes, including core dump attributes.
bool	found_prpsinfo = false
	Flag indicating if the NT_PRPSINFO note has been found and parsed.

Detailed Description

Helper class responsible for parsing the specific NOTE sections of an ELF core dump file.

Constructor & Destructor Documentation

ElfCoredumpParser()

arion::ElfCoredumpParser::ElfCoredumpParser ( std::weak_ptr< Arion >  arion )

inline

Builder for ElfCoredumpParser instances.

Parameters

[in]

arion

Weak pointer to the main Arion instance.

Member Function Documentation

parse_coredump_data()

std::unique_ptr< LIEF::ELF::Binary > arion::ElfCoredumpParser::parse_coredump_data	(	std::unique_ptr< LIEF::ELF::Binary >	elf,
		std::shared_ptr< ELF_PARSER_ATTRIBUTES >	attrs,
		std::vector< std::shared_ptr< struct SEGMENT > >	segments
	)

Iterates over all notes in the core dump binary and extracts thread context and memory map information.

Parameters

[in]	elf	The unique pointer to the LIEF ELF Binary representation.
[in,out]	attrs	The shared pointer to the attributes where parsed data will be stored.
[in]	segments	List of memory segments parsed from the loadable program headers.

Returns

The unique pointer to the LIEF ELF Binary.

parse_file_note()

void arion::ElfCoredumpParser::parse_file_note ( const LIEF::ELF::Note &  note, std::vector< std::shared_ptr< struct SEGMENT > >  segments  )

private

Parses the NT_FILE note, which contains information about the mapped files (segments).

Parameters

[in]	note	The LIEF Note structure containing the NT_FILE data.
[in]	segments	List of segments already loaded/known.

parse_fpregset_note()

void arion::ElfCoredumpParser::parse_fpregset_note ( const LIEF::ELF::Note &  note, std::shared_ptr< ELF_PARSER_ATTRIBUTES >  attrs  )

private

Parses the NT_FPREGSET note, containing floating-point register state for a thread.

Parameters

[in]	note	The LIEF Note structure containing the NT_FPREGSET data.
[in]	attrs	Shared pointer to the parser attributes.

parse_prpsinfo_note()

void arion::ElfCoredumpParser::parse_prpsinfo_note ( const LIEF::ELF::Note &  note, std::shared_ptr< ELF_PARSER_ATTRIBUTES >  attrs  )

private

Parses the NT_PRPSINFO note, containing process status info (e.g., command line, PID, UID).

Parameters

[in]	note	The LIEF Note structure containing the NT_PRPSINFO data.
[in]	attrs	Shared pointer to the parser attributes.

parse_prstatus_note()

void arion::ElfCoredumpParser::parse_prstatus_note ( const LIEF::ELF::Note &  note, std::shared_ptr< ELF_PARSER_ATTRIBUTES >  attrs  )

private

Parses the NT_PRSTATUS note, containing general-purpose register state for a thread.

Parameters

[in]	note	The LIEF Note structure containing the NT_PRSTATUS data.
[in]	attrs	Shared pointer to the parser attributes.

Member Data Documentation

arion

std::weak_ptr<Arion> arion::ElfCoredumpParser::arion

private

Weak pointer back to the main Arion instance.

attrs

std::shared_ptr<ELF_PARSER_ATTRIBUTES> arion::ElfCoredumpParser::attrs

private

Shared pointer to the parser attributes, including core dump attributes.

found_prpsinfo

bool arion::ElfCoredumpParser::found_prpsinfo = false

private

Flag indicating if the NT_PRPSINFO note has been found and parsed.

---

The documentation for this class was generated from the following file:

• /home/runner/work/Arion/Arion/include/arion/platforms/linux/elf_parser.hpp