MCPcopy Create free account
hub / github.com/MagnetForensics/dumpit-linux / write_to_archive

Method write_to_archive

src/main.rs:739–798  ·  view source on GitHub ↗
(
        &self,
        dst: &mut dyn Write
    )

Source from the content-addressed store, hash-verified

737 }
738
739 fn write_to_archive(
740 &self,
741 dst: &mut dyn Write
742 ) -> Result<()> {
743 // Writing the archive.
744 info!("Creating .tar.zst archive...");
745
746 let now = Utc::now();
747 let uts = uname()?;
748
749 // The main memory dump.
750 let file_name = format!("kcore.dumpit.{}.{}-{:02}-{:02}-{:02}{:02}.core",
751 uts.release().to_str().unwrap_or("uname"),
752 now.year(), now.month(), now.day(), now.hour(), now.minute());
753
754 let mut encoder = zstd::stream::Encoder::new(dst, 3)?;
755 {
756 let mut tar = tar::Builder::new(&mut encoder);
757
758 // TODO: Write additional useful files from /proc/
759 info!("Writing /proc/kallsyms file...");
760 let mut f = fs::File::open(format!("{}kallsyms", PROC_DIR))?;
761
762 let mut data = String::new();
763 f.read_to_string(&mut data)?;
764
765 let mut hdr_syms = tar::Header::new_gnu();
766 let hdr_syms_sz = data[..].as_bytes().len() as u64;
767 hdr_syms.set_size(hdr_syms_sz); // Manually set the size because it's a link file.
768 hdr_syms.set_path("proc/kallsyms")?;
769 hdr_syms.set_mode(0o644);
770 hdr_syms.set_uid(0);
771 hdr_syms.set_gid(0);
772 hdr_syms.set_mtime(0);
773 hdr_syms.set_cksum(); // Always call at the end.
774
775 tar.append(&mut hdr_syms, data[..].as_bytes())?;
776
777 info!("Writing {} file...", file_name);
778 let mut header = tar::Header::new_gnu();
779 let file_size = self.get_dump_size();
780 header.set_size(file_size);
781 header.set_path(&file_name)?;
782 header.set_mode(0o644);
783 header.set_uid(0);
784 header.set_gid(0);
785 header.set_mtime(0);
786 header.set_cksum();
787
788 tar.append(&mut header, std::io::empty())?;
789 self.write_kcore_dumpit(tar.get_mut())?;
790
791 tar.finish()?;
792 }
793
794 info!("Finished.");
795 encoder.finish()?;
796

Callers 1

mainFunction · 0.80

Calls 2

get_dump_sizeMethod · 0.80
write_kcore_dumpitMethod · 0.80

Tested by

no test coverage detected