linux_coredump.c

Go to the documentation of this file.

// SPDX-FileCopyrightText: 2016 Oscar Salvador <osalvador.vilardaga@gmail.com>
// SPDX-License-Identifier: LGPL-3.0-only
 
#include <rz_debug.h>
 
#if __x86_64__ || __i386__ || __arm__ || __arm64__
#include <sys/uio.h>
#include <sys/ptrace.h>
#include <asm/ptrace.h>
#include "linux_coredump.h"
#include "linux_ptrace.h"
 
/* For compatibility */
#if __x86_64__ || __arm64__
typedef Elf64_auxv_t elf_auxv_t;
typedef Elf64_Ehdr elf_hdr_t;
typedef Elf64_Phdr elf_phdr_t;
typedef Elf64_Shdr elf_shdr_t;
typedef Elf64_Nhdr elf_nhdr_t;
typedef ut32 elf_offset_t;
#elif __i386__ || __arm__
typedef Elf32_auxv_t elf_auxv_t;
typedef Elf32_Ehdr elf_hdr_t;
typedef Elf32_Phdr elf_phdr_t;
typedef Elf32_Shdr elf_shdr_t;
typedef Elf32_Nhdr elf_nhdr_t;
typedef ut64 elf_offset_t;
#endif
 
#define fmt_addr     "%08lx-%08lx"
#define ELF_HDR_SIZE sizeof(elf_hdr_t)
 
/*Some fields from note section must be padded to 4 or 8 bytes*/
#define round_up(a)        ((((a) + (4) - (1)) / (4)) * (4))
#define sizeof_round_up(b) round_up(sizeof(b))
 
static map_file_t mapping_file = { 0, 0 };
static note_info_t note_info[NT_LENGHT_T];
 
static bool is_a_kernel_mapping(const char *name) {
    return !(name && strcmp(name, "[vdso]") && strcmp(name, "[vsyscall]") && strcmp(name, "[vvar]") && strcmp(name, "[heap]") && strcmp(name, "[vectors]") && strncmp(name, "[stack", strlen("[stack")));
}
 
static char *prpsinfo_get_psargs(char *buffer, int len) {
    char paux[ELF_PRARGSZ];
    int i, bytes_left;
    char *p = rz_mem_dup(buffer, len);
    if (!p) {
        return NULL;
    }
    bytes_left = strlen(buffer);
    buffer = strchr(buffer, '\0');
    if (!buffer) {
        free(p);
        return NULL;
    }
 
    for (i = 0; i + bytes_left < len && i + bytes_left < ELF_PRARGSZ - 1; i++) {
        if (!buffer[i]) {
            buffer[i] = ' ';
        }
        paux[i] = buffer[i];
    }
    paux[i] = '\0';
    strncat(p, paux, len - bytes_left - 1);
    return p;
}
 
static prpsinfo_t *linux_get_prpsinfo(RzDebug *dbg, proc_per_process_t *proc_data) {
    const char *prog_states = "RSDTZW"; /* fs/binfmt_elf.c from kernel */
    const char *basename = NULL;
    char *buffer, *pfname = NULL, *ppsargs = NULL, *file = NULL;
    prpsinfo_t *p;
    pid_t mypid;
    size_t len;
 
    p = RZ_NEW0(prpsinfo_t);
    if (!p) {
        eprintf("Couldn't allocate memory for prpsinfo_t\n");
        return NULL;
    }
 
    p->pr_pid = mypid = dbg->pid;
    /* Start filling pr_fname and pr_psargs */
    file = sdb_fmt("/proc/%d/cmdline", mypid);
    buffer = rz_file_slurp(file, &len);
    if (!buffer) {
        eprintf("buffer NULL\n");
        goto error;
    }
    buffer[len] = 0;
    pfname = strdup(buffer);
    if (!pfname) {
        goto error;
    }
    basename = rz_file_basename(pfname);
    strncpy(p->pr_fname, basename, sizeof(p->pr_fname) - 1);
    p->pr_fname[sizeof(p->pr_fname) - 1] = 0;
    ppsargs = prpsinfo_get_psargs(buffer, (int)len);
    if (!ppsargs) {
        goto error;
    }
 
    strncpy(p->pr_psargs, ppsargs, sizeof(p->pr_psargs) - 1);
    p->pr_psargs[sizeof(p->pr_psargs) - 1] = 0;
    free(buffer);
    free(ppsargs);
    free(pfname);
    p->pr_sname = proc_data->s_name;
    p->pr_zomb = (p->pr_sname == 'Z') ? 1 : 0;
    p->pr_state = strchr(prog_states, p->pr_sname) - prog_states;
    p->pr_ppid = proc_data->ppid;
    p->pr_pgrp = proc_data->pgrp;
    p->pr_sid = proc_data->sid;
    p->pr_flag = proc_data->flag;
    p->pr_nice = proc_data->nice;
    p->pr_uid = proc_data->uid;
    p->pr_gid = proc_data->gid;
    return p;
error:
    free(p);
    free(buffer);
    free(pfname);
    free(ppsargs);
    return NULL;
}
 
static proc_per_thread_t *get_proc_thread_content(int pid, int tid) {
    char *temp_p_sigpend, *temp_p_sighold, *p_sigpend, *p_sighold;
    size_t size;
    const char *file = sdb_fmt("/proc/%d/task/%d/stat", pid, tid);
 
    char *buff = rz_file_slurp(file, &size);
    if (!buff) {
        return NULL;
    }
 
    proc_per_thread_t *t = RZ_NEW0(proc_per_thread_t);
    if (!t) {
        free(buff);
        return NULL;
    }
    {
        char no_str[128];
        long unsigned int no_lui;
        int no_num;
        char no_char;
        ut32 no_ui;
        sscanf(buff, "%d %s %c %d %d %d %d %d %u %lu %lu %lu %lu"
                 "%" PFMT64x " %" PFMT64x " %ld %lu",
            &no_num, no_str, &no_char, &no_num, &no_num, &no_num,
            &no_num, &no_num, &no_ui, &no_lui, &no_lui, &no_lui,
            &no_lui, &t->utime, &t->stime, &t->cutime, &t->cstime);
        free(buff);
    }
 
    /* /proc/[pid]/status for uid, gid, sigpend and sighold */
    file = sdb_fmt("/proc/%d/task/%d/status", pid, tid);
    buff = rz_file_slurp(file, &size);
    if (!buff) {
        free(t);
        return NULL;
    }
 
    temp_p_sigpend = strstr(buff, "SigPnd");
    temp_p_sighold = strstr(buff, "SigBlk");
    if (!temp_p_sigpend || !temp_p_sighold) {
        free(buff);
        free(t);
        return NULL;
    }
    while (!isdigit((ut8)*temp_p_sigpend++)) {
        // empty body
    }
    p_sigpend = temp_p_sigpend - 1;
    while (isdigit((ut8)*temp_p_sigpend++)) {
        // empty body
    }
    p_sigpend[temp_p_sigpend - p_sigpend - 1] = '\0';
    while (!isdigit((ut8)*temp_p_sighold++)) {
        // empty body
    }
    p_sighold = temp_p_sighold - 1;
    while (isdigit((ut8)*temp_p_sighold++)) {
        // empty body
    }
    p_sighold[temp_p_sighold - p_sighold - 1] = '\0';
    t->sigpend = atoi(p_sigpend);
    t->sighold = atoi(p_sighold);
    free(buff);
    return t;
}
 
static prstatus_t *linux_get_prstatus(RzDebug *dbg, int pid, int tid, proc_content_t *proc_data, short int signr) {
    elf_gregset_t regs;
    prstatus_t *p;
 
    proc_data->per_thread = get_proc_thread_content(pid, tid);
    if (!proc_data->per_thread) {
        return NULL;
    }
    p = RZ_NEW0(prstatus_t);
    if (!p) {
        return NULL;
    }
    p->pr_cursig = p->pr_info.si_signo = signr;
    p->pr_pid = tid;
    p->pr_ppid = proc_data->per_process->ppid;
    p->pr_pgrp = proc_data->per_process->pgrp;
    p->pr_sid = proc_data->per_process->sid;
    p->pr_sigpend = proc_data->per_thread->sigpend;
    p->pr_sighold = proc_data->per_thread->sighold;
    p->pr_utime.tv_sec = proc_data->per_thread->utime / 1000;
    p->pr_utime.tv_usec = (proc_data->per_thread->utime % 1000) / 1000;
    p->pr_stime.tv_sec = proc_data->per_thread->stime / 1000;
    p->pr_stime.tv_usec = (proc_data->per_thread->stime % 1000) / 1000;
    p->pr_cutime.tv_sec = proc_data->per_thread->cutime / 1000;
    p->pr_cutime.tv_usec = (proc_data->per_thread->cutime % 1000) / 1000;
    p->pr_cstime.tv_sec = proc_data->per_thread->cstime / 1000;
    p->pr_cstime.tv_usec = (proc_data->per_thread->cstime % 1000) / 1000;
 
    if (rz_debug_ptrace(dbg, PTRACE_GETREGS, tid, NULL, &regs) < 0) {
        perror("PTRACE_GETREGS");
        RZ_FREE(proc_data->per_thread);
        free(p);
        return NULL;
    }
    memcpy(p->pr_reg, &regs, sizeof(regs));
    RZ_FREE(proc_data->per_thread);
    return p;
}
 
static elf_fpregset_t *linux_get_fp_regset(RzDebug *dbg, int pid) {
    elf_fpregset_t *p = RZ_NEW0(elf_fpregset_t);
    if (p) {
        if (rz_debug_ptrace(dbg, PTRACE_GETFPREGS, pid, NULL, p) < 0) {
            perror("PTRACE_GETFPREGS");
            free(p);
            return NULL;
        }
        return p;
    }
    return NULL;
}
 
static siginfo_t *linux_get_siginfo(RzDebug *dbg, int pid) {
    siginfo_t *siginfo = RZ_NEW0(siginfo_t);
    if (!siginfo) {
        return NULL;
    }
    int ret = rz_debug_ptrace(dbg, PTRACE_GETSIGINFO, pid, 0, (rz_ptrace_data_t)(size_t)siginfo);
    if (ret == -1 || !siginfo->si_signo) {
        perror("PTRACE_GETSIGINFO");
        free(siginfo);
        return NULL;
    }
    return siginfo;
}
 
static bool has_map_deleted_part(char *name) {
    if (name) {
        const char deleted_str[] = "(deleted)";
        int len_name = strlen(name);
        int len_suffx = strlen(deleted_str);
        return !strncmp(name + len_name - len_suffx, deleted_str, len_suffx);
    }
    return false;
}
 
static bool getAnonymousValue(char *keyw) {
    if (!keyw) {
        return false;
    }
    keyw = strchr(keyw, ' ');
    if (!keyw) {
        return false;
    }
    while (*keyw && isspace((ut8)*keyw)) {
        keyw++;
    }
    return *keyw && *keyw != '0';
}
 
static char *isAnonymousKeyword(const char *pp) {
    if (!pp) {
        return NULL;
    }
    char *keyw = strstr(pp, "Anonymous:");
    if (!keyw) {
        keyw = strstr(pp, "AnonHugePages:");
    }
    return keyw;
}
 
static bool has_map_anonymous_content(char *buff_smaps, unsigned long start_addr, unsigned long end_addr) {
    char *pp, *extern_tok = NULL, *keyw = NULL;
    char *identity = rz_str_newf(fmt_addr, start_addr, end_addr);
    char *str = strdup(buff_smaps);
    char *p = strtok_r(str, "\n", &extern_tok);
    for (; p; p = strtok_r(NULL, "\n", &extern_tok)) {
        if (strstr(p, identity)) {
            pp = strtok_r(NULL, "\n", &extern_tok);
            for (; pp; pp = strtok_r(NULL, "\n", &extern_tok)) {
                if ((keyw = isAnonymousKeyword(pp))) {
                    bool is_anonymous = getAnonymousValue(keyw);
                    free(identity);
                    free(str);
                    return is_anonymous;
                }
            }
        }
    }
    free(identity);
    free(str);
    return 0;
}
 
static bool dump_this_map(char *buff_smaps, linux_map_entry_t *entry, ut8 filter_flags) {
    char *p, *pp, *ppp, *extern_tok, *flags_str = NULL;
    char *identity = rz_str_newf(fmt_addr, entry->start_addr, entry->end_addr);
    bool found = false;
    char *aux = NULL;
    ut8 vmflags = 0, perms = entry->perms;
 
    if (!identity) {
        return false;
    }
    /* if the map doesn't have r/w quit right here */
    if ((!(perms & RZ_PERM_R) && !(perms & RZ_PERM_W))) {
        free(identity);
        return false;
    }
    aux = strdup(buff_smaps);
    if (!aux) {
        free(identity);
        return false;
    }
 
    pp = strtok_r(aux, "\n", &extern_tok);
    for (; pp; pp = strtok_r(NULL, "\n", &extern_tok)) {
        if (strstr(pp, identity)) {
            ppp = strtok_r(NULL, "\n", &extern_tok);
            for (; ppp; ppp = strtok_r(NULL, "\n", &extern_tok)) {
                if ((flags_str = strstr(ppp, "VmFlags:"))) {
                    found = true;
                    break;
                }
            }
        }
    }
 
    if (entry->file_backed) {
        if (filter_flags & MAP_FILE_PRIV) {
            goto beach;
        }
        if (filter_flags & MAP_FILE_SHR) {
            goto beach;
        }
    }
 
    if (!flags_str || !found) {
        /* if we don't have VmFlags, let's check it out in another way */
        if (entry->kernel_mapping) {
            goto beach;
        }
 
        if (perms & !entry->shared) {
            if ((filter_flags & MAP_ANON_PRIV) && entry->anonymous) {
                goto beach;
            }
            if ((filter_flags & MAP_HUG_PRIV) && entry->anonymous) {
                goto beach;
            }
        }
 
        if (perms & entry->shared) {
            if (filter_flags & MAP_ANON_SHR) {
                goto beach;
            }
            if (filter_flags & MAP_HUG_SHR) {
                goto beach;
            }
        }
    } else {
        /* We have VmFlags */
        flags_str = strchr(flags_str, ' ');
        if (!flags_str) {
            goto fail;
        }
        while (*flags_str++ == ' ') {
            // empty body
        }
        flags_str--;
        p = strtok(flags_str, " ");
        while (p) {
            if (!strncmp(p, "sh", 2)) {
                vmflags |= SH_FLAG;
            }
            if (!strncmp(p, "io", 2)) {
                vmflags |= IO_FLAG;
            }
            if (!strncmp(p, "ht", 2)) {
                vmflags |= HT_FLAG;
            }
            if (!strncmp(p, "dd", 2)) {
                vmflags |= DD_FLAG;
            }
            p = strtok(NULL, " ");
        }
 
        if (!(vmflags & SH_FLAG)) {
            vmflags |= PV_FLAG;
        }
        /* first check for dd and io flags */
        if ((vmflags & DD_FLAG) || (vmflags & IO_FLAG)) {
            goto fail;
        }
 
        /* if current map comes from kernel and does not have DD flag, just stop checking */
        if (entry->kernel_mapping) {
            goto beach;
        }
 
        if (vmflags & HT_FLAG) {
            if ((filter_flags & MAP_HUG_PRIV) && entry->anonymous) {
                goto beach;
            }
            if (filter_flags & MAP_HUG_SHR) {
                goto beach;
            }
        }
 
        if (vmflags & SH_FLAG) {
            if (filter_flags & MAP_ANON_SHR) {
                goto beach;
            }
            if (filter_flags & MAP_HUG_SHR) {
                goto beach;
            }
        }
 
        if (vmflags & PV_FLAG) {
            if ((filter_flags & MAP_ANON_PRIV) && entry->anonymous) {
                goto beach;
            }
            if ((filter_flags & MAP_HUG_PRIV) && entry->anonymous) {
                goto beach;
            }
        }
    }
 
fail:
    free(identity);
    free(aux);
    return false;
beach:
    free(identity);
    free(aux);
    return true;
}
 
static void clean_maps(linux_map_entry_t *h) {
    linux_map_entry_t *aux, *p = h;
    while (p) {
        aux = p;
        p = p->n;
        free(aux);
    }
}
 
static linux_map_entry_t *linux_get_mapped_files(RzDebug *dbg, ut8 filter_flags) {
    linux_map_entry_t *me_head = NULL, *me_tail = NULL;
    RzListIter *iter;
    RzDebugMap *map;
    bool is_anonymous = false, is_deleted = false, ret = 0;
    char *file = NULL, *buff_maps = NULL, *buff_smaps = NULL;
    size_t size_file = 0;
 
    file = rz_str_newf("/proc/%d/smaps", dbg->pid);
    buff_smaps = rz_file_slurp(file, &size_file);
    if (!buff_smaps) {
        goto error;
    }
    RZ_FREE(file);
 
    file = rz_str_newf("/proc/%d/maps", dbg->pid);
    buff_maps = rz_file_slurp(file, &size_file);
    if (!buff_maps) {
        goto error;
    }
    RZ_FREE(file);
 
    ret = rz_debug_map_sync(dbg);
    if (!ret) {
        goto error;
    }
    rz_list_foreach (dbg->maps, iter, map) {
        linux_map_entry_t *pmentry = RZ_NEW0(linux_map_entry_t);
        if (!pmentry) {
            goto error;
        }
        pmentry->start_addr = map->addr;
        pmentry->end_addr = map->addr_end;
        pmentry->offset = map->offset;
        pmentry->name = strncmp(map->name, "unk", strlen("unk"))
            ? strdup(map->name)
            : NULL;
        pmentry->perms = map->perm;
        pmentry->shared = map->shared;
        pmentry->kernel_mapping = false;
        /* Check if is a kernel mapping */
        if (pmentry->name && is_a_kernel_mapping(pmentry->name)) {
            pmentry->anonymous = pmentry->kernel_mapping = true;
        } else {
            /* Check if map has anonymous content by checking Anonymous and AnonHugePages */
            is_anonymous = has_map_anonymous_content(buff_smaps, pmentry->start_addr, pmentry->end_addr);
            if (!is_anonymous && pmentry->name) {
                is_anonymous = is_deleted = has_map_deleted_part(pmentry->name);
            }
            pmentry->anonymous = is_anonymous;
        }
        if (pmentry->name && !pmentry->kernel_mapping && !is_deleted) {
            pmentry->file_backed = true;
        }
        pmentry->dumpeable = dump_this_map(buff_smaps, pmentry, filter_flags);
        eprintf(fmt_addr " - anonymous: %d, kernel_mapping: %d, file_backed: %d, dumpeable: %d\n",
            pmentry->start_addr, pmentry->end_addr,
            pmentry->anonymous, pmentry->kernel_mapping,
            pmentry->file_backed, pmentry->dumpeable);
        if (pmentry->file_backed) {
            const char *name = pmentry->name;
            if (!name) {
                name = "";
            }
            mapping_file.size += SIZE_NT_FILE_DESCSZ + strlen(name) + 1;
            mapping_file.count++;
        }
        ADD_MAP_NODE(pmentry);
    }
    /* number of mappings and page size */
    mapping_file.size += sizeof(unsigned long) * 2;
    free(buff_maps);
    free(buff_smaps);
 
    return me_head;
error:
    free(buff_maps);
    free(buff_smaps);
    free(file);
    clean_maps(me_head);
    return NULL;
}
 
static auxv_buff_t *linux_get_auxv(RzDebug *dbg) {
    char *buff = NULL;
    auxv_buff_t *auxv = NULL;
    int auxv_entries;
    size_t size;
 
    const char *file = sdb_fmt("/proc/%d/auxv", dbg->pid);
    buff = rz_file_slurp(file, &size);
    if (!buff) {
        return NULL;
    }
 
    auxv_entries = size / sizeof(elf_auxv_t);
    if (auxv_entries > 0) {
        auxv = RZ_NEW0(auxv_buff_t);
        if (!auxv) {
            free(buff);
            return NULL;
        }
        auxv->size = size;
        auxv->data = rz_mem_dup(buff, (int)size);
        if (!auxv->data) {
            free(buff);
            free(auxv);
            return NULL;
        }
    }
    free(buff);
    return auxv;
}
 
static elf_hdr_t *build_elf_hdr(int n_segments) {
    int pad_byte;
    int ph_size;
    int ph_offset;
    elf_hdr_t *h = RZ_NEW0(elf_hdr_t);
    if (!h) {
        return NULL;
    }
 
    ph_offset = ELF_HDR_SIZE;
    ph_size = sizeof(elf_phdr_t);
    h->e_ident[EI_MAG0] = ELFMAG0;
    h->e_ident[EI_MAG1] = ELFMAG1;
    h->e_ident[EI_MAG2] = ELFMAG2;
    h->e_ident[EI_MAG3] = ELFMAG3;
#if __x86_64__ || __arm64__
    h->e_ident[EI_CLASS] = ELFCLASS64; /*64bits */
#elif __i386__ || __arm__
    h->e_ident[EI_CLASS] = ELFCLASS32;
#endif
    h->e_ident[EI_DATA] = ELFDATA2LSB;
    h->e_ident[EI_VERSION] = EV_CURRENT;
    h->e_ident[EI_OSABI] = ELFOSABI_NONE;
    h->e_ident[EI_ABIVERSION] = 0x0;
 
    for (pad_byte = EI_PAD; pad_byte < EI_NIDENT; pad_byte++) {
        h->e_ident[pad_byte] = '\0';
    }
    h->e_type = ET_CORE;
#if __x86_64__
    h->e_machine = EM_X86_64;
#elif __i386__
    h->e_machine = EM_386;
#elif __arm__
    h->e_machine = EM_ARM;
#elif __arm64__
    h->e_machine = EM_AARCH64;
#endif
    h->e_version = EV_CURRENT;
    h->e_entry = 0x0;
    h->e_ehsize = ELF_HDR_SIZE;
    h->e_phoff = ph_offset;
    h->e_phentsize = ph_size;
    /* n_segments  + NOTE segment */
    h->e_phnum = (n_segments + 1) > PN_XNUM ? PN_XNUM : n_segments + 1;
    h->e_flags = 0x0;
    /* Coredump contains no sections */
    h->e_shoff = 0x0;
    h->e_shentsize = 0x0;
    h->e_shnum = 0x0;
    h->e_shstrndx = 0x0;
    return h;
}
 
static int get_info_mappings(linux_map_entry_t *me_head, size_t *maps_size) {
    linux_map_entry_t *p;
    int n_entries;
    for (n_entries = 0, p = me_head; p; p = p->n) {
        /* We don't count maps which does not have r/w perms */
        if (((p->perms & RZ_PERM_R) || (p->perms & RZ_PERM_W)) && p->dumpeable) {
            *maps_size += p->end_addr - p->start_addr;
            n_entries++;
        }
    }
    return n_entries;
}
 
static bool dump_elf_header(RzBuffer *dest, elf_hdr_t *hdr) {
    return rz_buf_append_bytes(dest, (const ut8 *)hdr, hdr->e_ehsize);
}
 
static void *get_ntfile_data(linux_map_entry_t *head) {
    char *maps_data, *pp;
    linux_map_entry_t *p;
    unsigned long n_pag, n_segments;
    size_t size = mapping_file.size;
 
    if ((int)size < 1) {
        return NULL;
    }
    n_segments = mapping_file.count;
    n_pag = 1;
    pp = maps_data = malloc(size);
    if (!maps_data) {
        return NULL;
    }
    memcpy(maps_data, &n_segments, sizeof(n_segments));
    memcpy(maps_data + sizeof(n_segments), &n_pag, sizeof(n_pag));
    pp += sizeof(n_segments) + sizeof(n_pag);
 
    for (p = head; p; p = p->n) {
        if (p->file_backed && !is_a_kernel_mapping(p->name)) {
            memcpy(pp, &p->start_addr, sizeof(p->start_addr));
            pp += sizeof(p->start_addr);
            memcpy(pp, &p->end_addr, sizeof(p->end_addr));
            pp += sizeof(p->end_addr);
            memcpy(pp, &p->offset, sizeof(p->offset));
            pp += sizeof(p->offset);
        }
    }
    for (p = head; p; p = p->n) {
        if (p->file_backed && !is_a_kernel_mapping(p->name)) {
            strncpy(pp, p->name, size - (pp - maps_data));
            pp += strlen(p->name) + 1;
        }
    }
    return maps_data;
}
 
static bool dump_elf_pheaders(RzBuffer *dest, linux_map_entry_t *maps, elf_offset_t *offset, size_t note_section_size) {
    linux_map_entry_t *me_p;
    elf_offset_t offset_to_next;
    elf_phdr_t phdr;
    bool ret;
 
    /* Start with note */
    phdr.p_type = PT_NOTE;
    phdr.p_flags = PF_R;
    phdr.p_offset = *offset;
    phdr.p_vaddr = 0x0;
    phdr.p_paddr = 0x0;
    phdr.p_filesz = note_section_size;
    phdr.p_memsz = 0x0;
    phdr.p_align = 0x1;
 
    if (!rz_buf_append_bytes(dest, (const ut8 *)&phdr, sizeof(elf_phdr_t))) {
        return false;
    }
 
    offset_to_next = *offset + note_section_size;
 
    /* write program headers */
    for (me_p = maps; me_p; me_p = me_p->n) {
        if ((!(me_p->perms & RZ_PERM_R) && !(me_p->perms & RZ_PERM_W)) || !me_p->dumpeable) {
            continue;
        }
        phdr.p_type = PT_LOAD;
        phdr.p_flags = me_p->perms;
        phdr.p_vaddr = me_p->start_addr;
        phdr.p_paddr = 0x0;
        phdr.p_memsz = me_p->end_addr - me_p->start_addr;
        phdr.p_filesz = me_p->dumpeable == 0 ? 0 : phdr.p_memsz;
        phdr.p_offset = offset_to_next;
        phdr.p_align = 0x1;
        offset_to_next += phdr.p_filesz == 0 ? 0 : phdr.p_filesz;
        ret = rz_buf_append_bytes(dest, (const ut8 *)&phdr, sizeof(elf_phdr_t));
        if (!ret) {
            return false;
        }
        memset(&phdr, '\0', sizeof(elf_phdr_t));
    }
 
    *offset = offset_to_next;
    return true;
}
 
static bool dump_elf_note(RzBuffer *dest, void *note_data, size_t note_section_size) {
    return rz_buf_append_bytes(dest, (const ut8 *)note_data, note_section_size);
}
 
static bool dump_elf_map_content(RzDebug *dbg, RzBuffer *dest, linux_map_entry_t *head, pid_t pid) {
    linux_map_entry_t *p;
    ut8 *map_content;
    size_t size;
    bool ret;
 
    eprintf("dump_elf_map_content starting\n\n");
 
    for (p = head; p; p = p->n) {
        if (!p->dumpeable) {
            continue;
        }
        size = p->end_addr - p->start_addr;
        map_content = malloc(size);
        if (!map_content) {
            return false;
        }
        ret = dbg->iob.read_at(dbg->iob.io, p->start_addr, map_content, size);
        if (!ret) {
            eprintf("Problems reading %" PFMTSZd " bytes at %" PFMT64x "\n", size, (ut64)p->start_addr);
        } else {
            ret = rz_buf_append_bytes(dest, (const ut8 *)map_content, size);
            if (!ret) {
                eprintf("rz_buf_append_bytes - failed\n");
            }
        }
        free(map_content);
    }
    eprintf("dump_elf_map_content - done\n");
    return true;
}
 
static proc_per_process_t *get_proc_process_content(RzDebug *dbg) {
    proc_per_process_t *p;
    char *temp_p_uid, *temp_p_gid, *p_uid, *p_gid;
    ut16 filter_flags, default_filter_flags = 0x33;
    char *buff;
    const char *file = sdb_fmt("/proc/%d/stat", dbg->pid);
    size_t size;
 
    buff = rz_file_slurp(file, &size);
    if (!buff) {
        return NULL;
    }
 
    p = RZ_NEW0(proc_per_process_t);
    if (!p) {
        free(buff);
        return NULL;
    }
 
    /* /proc/[pid]/stat */
    /* we only need few fields which are process-wide */
    {
        char no_str[128];
        long unsigned int no_lui;
        long int no_li;
        int no_num;
        sscanf(buff, "%d %s %c %d %d %d %d %d %u %lu %lu %lu %lu"
                 "%lu %lu %ld %ld %ld %ld %ld",
            &p->pid, no_str, &p->s_name, &p->ppid, &p->pgrp, &no_num,
            &no_num, &p->sid, &p->flag, &no_lui, &no_lui, &no_lui,
            &no_lui, &no_lui, &no_lui, &no_li, &no_li,
            &no_li, &p->nice, &p->num_threads);
        free(buff);
    }
    if (!p->num_threads || p->num_threads < 1) {
        free(p);
        eprintf("Warning: number of threads is < 1\n");
        return NULL;
    }
    file = sdb_fmt("/proc/%d/status", dbg->pid);
    buff = rz_file_slurp(file, &size);
    if (!buff) {
        free(p);
        return NULL;
    }
    temp_p_uid = strstr(buff, "Uid:");
    temp_p_gid = strstr(buff, "Gid:");
    /* Uid */
    if (temp_p_uid) {
        while (!isdigit((ut8)*temp_p_uid++)) {
            // empty body
        }
        p_uid = temp_p_uid - 1;
        while (isdigit((ut8)*temp_p_uid++)) {
            // empty body
        }
        p_uid[temp_p_uid - p_uid - 1] = '\0';
    } else {
        p_uid = NULL;
    }
    p->uid = p_uid ? atoi(p_uid) : 0;
 
    /* Gid */
    if (temp_p_gid) {
        while (!isdigit((ut8)*temp_p_gid++)) {
            // empty body
        }
        p_gid = temp_p_gid - 1;
        while (isdigit((ut8)*temp_p_gid++)) {
            // empty body
        }
        p_gid[temp_p_gid - p_gid - 1] = '\0';
    } else {
        p_gid = NULL;
    }
    p->gid = p_gid ? atoi(p_gid) : 0;
 
    free(buff);
    /* Check the coredump_filter value if we have*/
    file = sdb_fmt("/proc/%d/coredump_filter", dbg->pid);
    buff = rz_file_slurp(file, &size);
    if (buff) {
        sscanf(buff, "%hx", &filter_flags);
        p->coredump_filter = filter_flags;
        free(buff);
    } else {
        /* Old kernels do not have coredump_filter, so just take the default one */
        p->coredump_filter = default_filter_flags;
    }
    return p;
}
 
static void may_clean_all(elf_proc_note_t *elf_proc_note, proc_content_t *proc_data, elf_hdr_t *elf_hdr) {
    RZ_FREE(elf_proc_note->prpsinfo);
    RZ_FREE(elf_proc_note->auxv);
    clean_maps(elf_proc_note->maps);
    free(elf_proc_note);
    RZ_FREE(proc_data->per_thread);
    RZ_FREE(proc_data->per_process);
    free(proc_data);
    free(elf_hdr);
}
 
static elf_shdr_t *get_extra_sectionhdr(elf_hdr_t *elf_hdr, st64 offset, int n_segments) {
    elf_shdr_t *shdr = RZ_NEW0(elf_shdr_t);
    if (!shdr) {
        return NULL;
    }
    elf_hdr->e_shoff = offset;
    elf_hdr->e_shentsize = sizeof(elf_shdr_t);
    elf_hdr->e_shnum = 1;
    elf_hdr->e_shstrndx = SHN_UNDEF;
    shdr->sh_type = SHT_NULL;
    shdr->sh_size = elf_hdr->e_shnum;
    shdr->sh_link = elf_hdr->e_shstrndx;
    shdr->sh_info = n_segments + 1;
    return shdr;
}
 
static bool dump_elf_sheader_pxnum(RzBuffer *dest, elf_shdr_t *shdr) {
    return rz_buf_append_bytes(dest, (const ut8 *)shdr, sizeof(*shdr));
}
 
#if __i386__
static elf_fpxregset_t *linux_get_fpx_regset(RzDebug *dbg, int tid) {
#ifdef PTRACE_GETREGSET
    struct iovec transfer;
    elf_fpxregset_t *fpxregset = RZ_NEW0(elf_fpxregset_t);
    if (fpxregset) {
        transfer.iov_base = fpxregset;
        transfer.iov_len = sizeof(elf_fpxregset_t);
        if (rz_debug_ptrace(dbg, PTRACE_GETREGSET, tid, (void *)NT_PRXFPREG, &transfer) < 0) {
            perror("linux_get_fpx_regset");
            RZ_FREE(fpxregset);
        }
    }
    return fpxregset;
#else
    return NULL;
#endif
}
#endif
 
#if __i386__ || __x86_64__
void *linux_get_xsave_data(RzDebug *dbg, int tid, ut32 size) {
#ifdef PTRACE_GETREGSET
    struct iovec transfer;
    char *xsave_data = calloc(size, 1);
    if (!xsave_data) {
        return NULL;
    }
    transfer.iov_base = xsave_data;
    transfer.iov_len = size;
    if (rz_debug_ptrace_get_x86_xstate(dbg, tid, &transfer) < 0) {
        free(xsave_data);
        return NULL;
    }
    return xsave_data;
#else
    return NULL;
#endif
}
#endif
 
#if __arm__ || __arm64__
void *linux_get_arm_vfp_data(RzDebug *dbg, int tid) {
#ifdef PTRACE_GETVFPREGS
    char *vfp_data = calloc(ARM_VFPREGS_SIZE + 1, 1);
    if (!vfp_data) {
        return NULL;
    }
 
    if (rz_debug_ptrace(dbg, PTRACE_GETVFPREGS, tid, 0, vfp_data) < 0) {
        perror("linux_get_arm_vfp_data");
        free(vfp_data);
        return NULL;
    }
    return vfp_data;
#else
    return NULL;
#endif
}
#endif
 
void write_note_hdr(note_type_t type, ut8 **note_data) {
    elf_nhdr_t nhdr;
    static size_t size_note_hdr = sizeof(elf_nhdr_t);
    ut32 note_type;
 
    switch (type) {
    case NT_PRPSINFO_T:
        note_type = NT_PRPSINFO;
        nhdr.n_descsz = note_info[type].size;
        break;
    case NT_AUXV_T:
        note_type = NT_AUXV;
        nhdr.n_descsz = note_info[type].size;
        break;
    case NT_FILE_T:
        note_type = NT_FILE;
        nhdr.n_descsz = note_info[type].size;
        break;
    case NT_PRSTATUS_T:
        note_type = NT_PRSTATUS;
        nhdr.n_descsz = note_info[type].size;
        break;
    case NT_FPREGSET_T:
        note_type = NT_FPREGSET;
        nhdr.n_descsz = note_info[type].size;
        break;
#if __i386__
    case NT_PRXFPREG_T:
        note_type = NT_PRXFPREG;
        nhdr.n_descsz = note_info[type].size;
        break;
#endif
    case NT_SIGINFO_T:
        note_type = NT_SIGINFO;
        nhdr.n_descsz = note_info[type].size;
        break;
#if __i386__ || __x86_64__
    case NT_X86_XSTATE_T:
        note_type = NT_X86_XSTATE;
        nhdr.n_descsz = note_info[type].size;
        break;
#elif __arm__ || __arm64__
    case NT_ARM_VFP_T:
        note_type = NT_ARM_VFP;
        nhdr.n_descsz = note_info[type].size;
        break;
#endif
    default:
        /* shouldn't happen */
        memset(*note_data, 0, size_note_hdr);
        return;
    }
 
    nhdr.n_type = note_type;
    if (note_type == NT_X86_XSTATE || note_type == NT_ARM_VFP || note_type == NT_PRXFPREG) {
        nhdr.n_namesz = sizeof("LINUX");
    } else {
        nhdr.n_namesz = sizeof("CORE");
    }
 
    memcpy(*note_data, (void *)&nhdr, size_note_hdr);
    *note_data += size_note_hdr;
}
 
static int *get_unique_thread_id(RzDebug *dbg, int n_threads) {
    RzListIter *it;
    RzList *list;
    RzDebugPid *th;
    int *thread_id = NULL;
    int i = 0;
    bool found = false;
 
    if (dbg->cur) {
        list = dbg->cur->threads(dbg, dbg->pid);
        if (!list) {
            return NULL;
        }
        thread_id = calloc(sizeof(int), n_threads);
        if (!thread_id) {
            return NULL; /* free list */
        }
        rz_list_foreach (list, it, th) {
            if (th->pid) {
                int j;
                for (j = 0; j < i && !found; j++) {
                    if (th->pid == thread_id[j]) {
                        found = true;
                        break;
                    }
                }
                if (!found) {
                    /* Adding to array and attaching to thread */
                    thread_id[i] = th->pid;
                    /* The main thread is already being traced */
                    if (th->pid != dbg->pid) {
                        if (rz_debug_ptrace(dbg, PTRACE_ATTACH, thread_id[i], 0, 0) < 0) {
                            perror("Could not attach to thread");
                        }
                    }
                    i++;
                }
                found = false;
            }
        }
        free(list);
    }
    return thread_id;
}
 
void detach_threads(RzDebug *dbg, int *thread_id, int n_threads) {
    int i;
    for (i = 0; i < n_threads; i++) {
        if (dbg->pid != thread_id[i]) {
            if (rz_debug_ptrace(dbg, PTRACE_DETACH, thread_id[i], 0, 0) < 0) {
                perror("PTRACE_DETACH");
            }
        }
    }
}
 
static ut8 *build_note_section(RzDebug *dbg, elf_proc_note_t *elf_proc_note, proc_content_t *proc_data, size_t *section_size) {
    ut8 *note_data, *pnote_data;
    char *maps_data;
    int i, n_notes = 0, *thread_id;
    size_t size = 0;
    note_type_t type;
#if __i386__
    bool fpx_flag = false;
#endif
#if __i386__ || __x86_64__
    bool xsave_flag = false;
#elif __arm__ || __arm64__
    bool vfp_flag = false;
#endif
 
    maps_data = get_ntfile_data(elf_proc_note->maps);
    if (!maps_data) {
        return NULL;
    }
 
    thread_id = get_unique_thread_id(dbg, elf_proc_note->n_threads);
    if (!thread_id) {
        free(maps_data);
        return NULL;
    }
 
    /* NT_* per proc */
    /* NT_PRPSINFO */
    type = NT_PRPSINFO_T;
    size += note_info[type].size_roundedup;
    size += note_info[type].size_name;
    n_notes++;
    /* NT_AUXV */
    type = NT_AUXV_T;
    size += note_info[type].size_roundedup;
    size += note_info[type].size_name;
    n_notes++;
    /* NT_FILE */
    type = NT_FILE_T;
    size += note_info[type].size_roundedup;
    size += note_info[type].size_name;
    n_notes++;
 
    /* NT_* per thread: NT_PRSTATUS, NT_SIGINFO, NT_FPREGSET, (NT_PRXFPREG), NT_X86_XSTATE */
    for (i = 0; i < elf_proc_note->n_threads; i++) {
        type = NT_PRSTATUS_T;
        size += note_info[type].size_roundedup;
        size += note_info[type].size_name;
        n_notes++;
        type = NT_SIGINFO_T;
        size += note_info[type].size_roundedup;
        size += note_info[type].size_name;
        n_notes++;
        type = NT_FPREGSET_T;
        size += note_info[type].size_roundedup;
        size += note_info[type].size_name;
        n_notes++;
#if __i386__
        type = NT_PRXFPREG_T;
        if (note_info[type].size) {
            fpx_flag = true;
            size += note_info[type].size_roundedup;
            size += note_info[type].size_name;
            n_notes++;
        }
#endif
#if __i386__ || __x86_64__
        type = NT_X86_XSTATE_T;
        if (note_info[type].size) {
            xsave_flag = true;
            size += note_info[type].size_roundedup;
            size += note_info[type].size_name;
            n_notes++;
        }
#endif
#if __arm__ || __arm64__
        type = NT_ARM_VFP_T;
        if (note_info[type].size) {
            vfp_flag = true;
            size += note_info[type].size_roundedup;
            size += note_info[type].size_name;
            n_notes++;
        }
#endif
    }
    size += round_up(n_notes * sizeof(elf_nhdr_t));
    *section_size = size;
 
    /* Start building note */
    note_data = calloc(1, size);
    if (!note_data) {
        free(thread_id);
        free(maps_data);
        return NULL;
    }
    pnote_data = note_data;
    /* prpsinfo */
    type = NT_PRPSINFO_T;
    write_note_hdr(type, &note_data);
    memcpy(note_data, note_info[type].name, note_info[type].size_name);
    note_data += note_info[type].size_name;
    memcpy(note_data, elf_proc_note->prpsinfo, note_info[type].size);
    note_data += note_info[type].size_roundedup;
 
    /* prstatus + fpregset + (prxfpreg) + siginfo + x86xstate per thread */
    {
        elf_proc_note->thread_note = RZ_NEW0(thread_elf_note_t);
        if (!elf_proc_note->thread_note) {
            goto fail;
        }
        for (i = 0; i < elf_proc_note->n_threads; i++) {
            elf_proc_note->thread_note->siginfo = linux_get_siginfo(dbg, thread_id[i]);
            if (!elf_proc_note->thread_note->siginfo) {
                goto fail;
            }
            elf_proc_note->thread_note->prstatus = linux_get_prstatus(dbg, dbg->pid,
                thread_id[i], proc_data,
                elf_proc_note->thread_note->siginfo->si_signo);
            if (!elf_proc_note->thread_note->prstatus) {
                goto fail;
            }
            elf_proc_note->thread_note->fp_regset = linux_get_fp_regset(dbg, thread_id[i]);
            if (!elf_proc_note->thread_note->fp_regset) {
                goto fail;
            }
#if __i386__
            if (fpx_flag) {
                elf_proc_note->thread_note->fpx_regset = linux_get_fpx_regset(dbg, thread_id[i]);
                if (!elf_proc_note->thread_note->fpx_regset) {
                    goto fail;
                }
            }
#endif
#if __i386__ || __x86_64__
            if (xsave_flag) {
                elf_proc_note->thread_note->xsave_data = linux_get_xsave_data(dbg, thread_id[i],
                    note_info[NT_X86_XSTATE_T].size);
                if (!elf_proc_note->thread_note->xsave_data) {
                    goto fail;
                }
            }
#elif __arm__ || __arm64__
            if (vfp_flag) {
                elf_proc_note->thread_note->arm_vfp_data = linux_get_arm_vfp_data(dbg, thread_id[i]);
                if (!elf_proc_note->thread_note->arm_vfp_data) {
                    goto fail;
                }
            }
#endif
            type = NT_PRSTATUS_T;
            write_note_hdr(type, &note_data);
            memcpy(note_data, note_info[type].name, note_info[type].size_name);
            note_data += note_info[type].size_name;
            memcpy(note_data, elf_proc_note->thread_note->prstatus, note_info[type].size);
            note_data += note_info[type].size_roundedup;
 
            type = NT_FPREGSET_T;
            write_note_hdr(type, &note_data);
            memcpy(note_data, note_info[type].name, note_info[type].size_name);
            note_data += note_info[type].size_name;
            memcpy(note_data, elf_proc_note->thread_note->fp_regset, note_info[type].size);
            note_data += note_info[type].size_roundedup;
#if __i386__
            if (fpx_flag) {
                type = NT_PRXFPREG_T;
                write_note_hdr(type, &note_data);
                memcpy(note_data, note_info[type].name, note_info[type].size_name);
                note_data += note_info[type].size_name;
                memcpy(note_data, elf_proc_note->thread_note->fpx_regset, note_info[type].size);
                note_data += note_info[type].size_roundedup;
                RZ_FREE(elf_proc_note->thread_note->fpx_regset);
            }
#endif
            type = NT_SIGINFO_T;
            write_note_hdr(type, &note_data);
            memcpy(note_data, note_info[type].name, note_info[type].size_name);
            note_data += note_info[type].size_name;
            memcpy(note_data, elf_proc_note->thread_note->fp_regset, note_info[type].size);
            note_data += note_info[type].size_roundedup;
 
#if __arm__ || __arm64
            if (vfp_flag) {
                type = NT_ARM_VFP_T;
                write_note_hdr(type, &note_data);
                memcpy(note_data, note_info[type].name, note_info[type].size_name);
                note_data += note_info[type].size_name;
                memcpy(note_data, elf_proc_note->thread_note->arm_vfp_data, note_info[type].size);
                note_data += note_info[type].size_roundedup;
                RZ_FREE(elf_proc_note->thread_note->arm_vfp_data);
            }
#endif
 
#if __i386__ || __x86_64__
            if (xsave_flag) {
                type = NT_X86_XSTATE_T;
                write_note_hdr(type, &note_data);
                memcpy(note_data, note_info[type].name, note_info[type].size_name);
                note_data += note_info[type].size_name;
                memcpy(note_data, elf_proc_note->thread_note->xsave_data, note_info[type].size);
                note_data += note_info[type].size_roundedup;
                RZ_FREE(elf_proc_note->thread_note->xsave_data);
            }
#endif
            RZ_FREE(elf_proc_note->thread_note->siginfo);
            RZ_FREE(elf_proc_note->thread_note->prstatus);
            RZ_FREE(elf_proc_note->thread_note->fp_regset);
        }
        free(elf_proc_note->thread_note);
    }
    type = NT_AUXV_T;
    write_note_hdr(type, &note_data);
    memcpy(note_data, note_info[type].name, note_info[type].size_name);
    note_data += note_info[type].size_name;
    memcpy(note_data, elf_proc_note->auxv->data, note_info[type].size);
    note_data += note_info[type].size_roundedup;
 
    type = NT_FILE_T;
    write_note_hdr(type, &note_data);
    memcpy(note_data, note_info[type].name, note_info[type].size_name);
    note_data += note_info[type].size_name;
    memcpy(note_data, maps_data, note_info[type].size);
    note_data += note_info[type].size_roundedup;
 
    detach_threads(dbg, thread_id, elf_proc_note->n_threads);
    free(thread_id);
    free(maps_data);
    return pnote_data;
fail:
    if (elf_proc_note->thread_note) {
        free(elf_proc_note->thread_note->siginfo);
        free(elf_proc_note->thread_note->prstatus);
        free(elf_proc_note->thread_note->fp_regset);
#if __i386__
        free(elf_proc_note->thread_note->fpx_regset);
#endif
#if __i386__ || __x86_64__
        free(elf_proc_note->thread_note->xsave_data);
#elif __arm__ || __arm64__
        free(elf_proc_note->thread_note->arm_vfp_data);
#endif
    }
    free(pnote_data);
    free(maps_data);
    free(thread_id);
    return NULL;
}
 
#if __i386__ || __x86_64__
static int get_xsave_size(RzDebug *dbg, int pid) {
#ifdef PTRACE_GETREGSET
    struct iovec local;
    unsigned long xstate_hdr[XSTATE_HDR_SIZE / sizeof(unsigned long)];
    unsigned long xcr0;
 
    /*We request with NT_X86_XSTATE. Maybe our PC does not have xsave flag. In that case errno would be -ENODEV.
    We could also check this by cpuid instruction https://en.wikipedia.org/wiki/CPUID#EAX.3D1:_Processor_Info_and_Feature_Bits*/
    local.iov_base = xstate_hdr;
    local.iov_len = sizeof(xstate_hdr);
    if (rz_debug_ptrace_get_x86_xstate(dbg, pid, &local) < 0) {
        return 0;
    }
 
    xcr0 = xstate_hdr[XCR0_OFFSET / sizeof(unsigned long)];
    switch (xcr0) {
    case XSTATE_SSE_MASK:
        return XSTATE_SSE_SIZE;
    case XSTATE_AVX_MASK:
        return XSTATE_AVX_SIZE;
    case XSTATE_MPX_MASK:
        return XSTATE_MPX_SIZE;
    case XSTATE_AVX512_MASK:
        return XSTATE_FULL_SIZE;
    default:
        return 0;
    }
#else
    return 0;
#endif
}
#endif
 
#if __i386__
static int get_i386_fpx_size(void) {
#ifdef PTRACE_GETREGSET
    return sizeof(elf_fpxregset_t);
#else
    return 0;
#endif
}
#endif
 
#if __arm__ || __arm64__
static int get_arm_vfpregs_size(void) {
#ifdef PTRACE_GETVFPREGS
    return ARM_VFPREGS_SIZE;
#else
    return 0;
#endif
}
#endif
 
static void init_note_info_structure(RzDebug *dbg, int pid, size_t auxv_size) {
    note_type_t type;
    int len_name_core = round_up(strlen("CORE") + 1);
    int len_name_linux = round_up(strlen("LINUX") + 1);
 
    /* NT_PRPSINFO_T */;
    type = NT_PRPSINFO_T;
    note_info[type].size = sizeof(prpsinfo_t);
    note_info[type].size_roundedup = sizeof_round_up(prpsinfo_t);
    note_info[type].size_name = len_name_core;
    strncpy(note_info[type].name, "CORE", sizeof(note_info[type].name));
    /* NT_AUXV_T */
    type = NT_AUXV_T;
    note_info[type].size = auxv_size;
    note_info[type].size_roundedup = round_up(auxv_size);
    note_info[type].size_name = len_name_core;
    strncpy(note_info[type].name, "CORE", sizeof(note_info[type].name));
    /* NT_FILE_T */
    type = NT_FILE_T;
    note_info[type].size = mapping_file.size;
    note_info[type].size_roundedup = round_up(mapping_file.size);
    note_info[type].size_name = len_name_core;
    strncpy(note_info[type].name, "CORE", sizeof(note_info[type].name));
    /* NT_PRSTATUS_T */
    type = NT_PRSTATUS_T;
    note_info[type].size = sizeof(prstatus_t);
    note_info[type].size_roundedup = sizeof_round_up(prstatus_t);
    note_info[type].size_name = len_name_core;
    strncpy(note_info[type].name, "CORE", sizeof(note_info[type].name));
    /* NT_SIGINFO_T */
    type = NT_SIGINFO_T;
    note_info[type].size = sizeof(siginfo_t);
    note_info[type].size_roundedup = sizeof_round_up(siginfo_t);
    note_info[type].size_name = len_name_core;
    strncpy(note_info[type].name, "CORE", sizeof(note_info[type].name));
    /* NT_FPREGSET_T */
    type = NT_FPREGSET_T;
    note_info[type].size = sizeof(elf_fpregset_t);
    note_info[type].size_roundedup = sizeof_round_up(elf_fpregset_t);
    note_info[type].size_name = len_name_core;
    strncpy(note_info[type].name, "CORE", sizeof(note_info[type].name));
#if __i386__
    type = NT_PRXFPREG_T;
    note_info[type].size = get_i386_fpx_size();
    note_info[type].size_roundedup = sizeof_round_up(elf_fpxregset_t);
    note_info[type].size_name = len_name_core;
    strncpy(note_info[type].name, "CORE", sizeof(note_info[type].name));
    type++;
#endif
#if __x86_64__ || __i386__
    /* NT_X86_XSTATE_T */
    type = NT_X86_XSTATE_T;
    note_info[type].size = get_xsave_size(dbg, pid);
    note_info[type].size_roundedup = round_up(note_info[type].size);
    note_info[type].size_name = len_name_linux;
    strncpy(note_info[type].name, "LINUX", sizeof(note_info[type].name));
#elif __arm__ || __arm64__
    /* NT_ARM_VFP_T */
    type = NT_ARM_VFP_T;
    note_info[type].size = get_arm_vfpregs_size();
    note_info[type].size_roundedup = round_up(note_info[type].size);
    note_info[type].size_name = len_name_linux;
    strncpy(note_info[type].name, "LINUX", sizeof(note_info[type].name));
#endif
}
 
bool linux_generate_corefile(RzDebug *dbg, RzBuffer *dest) {
    proc_content_t *proc_data = NULL;
    elf_proc_note_t *elf_proc_note = NULL;
    elf_shdr_t *shdr_pxnum = NULL;
    elf_hdr_t *elf_hdr = NULL;
    void *note_data = NULL;
    bool error = false;
    size_t note_section_size, maps_size = 0;
    int n_segments;
    ut32 hdr_size;
    elf_offset_t offset = 0;
 
    elf_proc_note = RZ_NEW0(elf_proc_note_t);
    if (!elf_proc_note) {
        return false;
    }
    proc_data = RZ_NEW0(proc_content_t);
    if (!proc_data) {
        free(elf_proc_note);
        return false;
    }
    proc_data->per_process = get_proc_process_content(dbg);
    if (!proc_data->per_process) {
        free(elf_proc_note);
        free(proc_data);
        return false;
    }
    elf_proc_note->n_threads = proc_data->per_process->num_threads;
 
    /* Get NT_ process_wide: AUXV, MAPS, PRPSINFO */
    /* NT_PRPSINFO */
    elf_proc_note->prpsinfo = linux_get_prpsinfo(dbg, proc_data->per_process);
    if (!elf_proc_note->prpsinfo) {
        error = true;
        goto cleanup;
    }
    /* NT_AUXV */
    elf_proc_note->auxv = linux_get_auxv(dbg);
    if (!elf_proc_note->auxv) {
        error = true;
        goto cleanup;
    }
    /* NT_FILE */
    elf_proc_note->maps = linux_get_mapped_files(dbg, proc_data->per_process->coredump_filter);
    if (!elf_proc_note->maps) {
        error = true;
        goto cleanup;
    }
    n_segments = get_info_mappings(elf_proc_note->maps, &maps_size);
 
    init_note_info_structure(dbg, dbg->pid, elf_proc_note->auxv->size);
    note_data = build_note_section(dbg, elf_proc_note, proc_data, &note_section_size);
    if (!note_data) {
        error = true;
        goto cleanup;
    }
 
    elf_hdr = build_elf_hdr(n_segments);
    if (!elf_hdr) {
        error = true;
        goto cleanup;
    }
 
    hdr_size = (proc_data->per_process->coredump_filter & MAP_ELF_HDR) ? elf_hdr->e_ehsize : 0;
    if (hdr_size) {
        if (elf_hdr->e_phnum == PN_XNUM) {
            elf_offset_t offset_shdr;
            /* Since extra section header must be placed at the end,
                we need to compute the total size to known at which position should be written */
            offset_shdr = hdr_size + (elf_hdr->e_phnum * elf_hdr->e_phentsize) + note_section_size + maps_size;
            shdr_pxnum = get_extra_sectionhdr(elf_hdr, offset_shdr, n_segments);
        }
        (void)dump_elf_header(dest, elf_hdr);
    }
    offset = hdr_size + (elf_hdr->e_phnum * elf_hdr->e_phentsize);
 
    /* Write to file */
    (void)dump_elf_pheaders(dest, elf_proc_note->maps, &offset, note_section_size);
    (void)dump_elf_note(dest, note_data, note_section_size);
    (void)dump_elf_map_content(dbg, dest, elf_proc_note->maps, dbg->pid);
    if (elf_hdr->e_phnum == PN_XNUM) {
        (void)dump_elf_sheader_pxnum(dest, shdr_pxnum);
    }
cleanup:
    may_clean_all(elf_proc_note, proc_data, elf_hdr);
    free(shdr_pxnum);
    free(note_data);
    return !error;
}
#endif