qemu/contrib/elf2dmp
Viktor Prutyanov d399d6b179 contrib/elf2dmp: add PE name check and Windows Server 2022 support
Since its inception elf2dmp has checked MZ signatures within an
address space above IDT[0] interrupt vector and took first PE image
found as Windows Kernel.
But in Windows Server 2022 memory dump this address space range is
full of invalid PE fragments and the tool must check that PE image
is 'ntoskrnl.exe' actually.
So, introduce additional validation by checking image name from
Export Directory against 'ntoskrnl.exe'.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-4-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21 13:19:07 +00:00
..
addrspace.c contrib/elf2dmp: fix code style 2023-03-21 11:54:39 +00:00
addrspace.h elf2dmp: Rename PAGE_SIZE to ELF2DMP_PAGE_SIZE 2021-01-20 10:46:54 +01:00
download.c elf2dmp: Check curl_easy_setopt() return value 2021-09-20 09:54:32 +01:00
download.h
err.h
kdbg.h contrib/elf2dmp: fix structures definitions 2019-02-05 16:50:17 +01:00
main.c contrib/elf2dmp: add PE name check and Windows Server 2022 support 2023-03-21 13:19:07 +00:00
meson.build meson: build contrib/ executables after generated headers 2022-01-12 14:09:06 +01:00
pdb.c elf2dmp: Fail cleanly if PDB file specifies zero block_size 2021-09-20 09:54:32 +01:00
pdb.h contrib/elf2dmp: fix structures definitions 2019-02-05 16:50:17 +01:00
pe.h contrib/elf2dmp: add PE name check and Windows Server 2022 support 2023-03-21 13:19:07 +00:00
qemu_elf.c contrib/elf2dmp: add ELF dump header checking 2022-05-25 21:26:35 +02:00
qemu_elf.h Clean up a few header guard symbols 2019-06-12 13:20:20 +02:00