Method parse_kcore

src/main.rs:629–667

(&mut self)

    }

    fn parse_kcore(&mut self) -> Result<()> {
        let mut buffer = vec![0u8; 1 * 0x100000];
        self.kcore.read(&mut buffer)?;

        // Support for x64/ARM64 version of Linux only.
        let in_data = &*buffer;
        let in_elf = FileHeader64::<Endianness>::parse(in_data)?;
        let endian = in_elf.endian()?;
        let in_segments = in_elf.program_headers(endian, in_data)?;

        // Step 1: Parse /proc/kcore to look for any missing MemoryRange through the PHdrs.
        // We filter out the invalid PT_LOAD.
        self.associate_mem_ranges(endian, &in_segments)?;

        // Step 2.1 - Check if VMCOREINFO is present. This happens with old Linux OSes.
        let is_vmci_present = self.is_vmcoreinfo_present(endian, &in_segments, in_data);
        
        // Step 2.2 - VMCOREINFO is missing so we need to add it manually.
        if is_vmci_present == false {
            info!("VMCOREINFO is absent from /proc/kcore.");
            info!("Reading vmcoreinfo_data...");
            self.read_vmcoreinfo()?;
        } else {
            info!("VMCOREINFO is present in /proc/kcore.");
        }

        // Step 3 - We are building a new ELF file header.
        // This means, that we:
        //  - Add the VMCOREINFO PT_NOTE if it's not present.
        //  - Keep only the useful PT_LOAD headers, with the correct p_offset.
        let out_header = self.build_elf_header(endian,
                                               &in_elf,
                                               &in_segments,
                                               in_data,
                                               in_elf.is_class_64())?;
        self.out_header  = Some(out_header);

        Ok(())
    }

    #[allow(dead_code)]
    fn display(&self) {