NAME=mdmp open
FILE=bins/mdmp/calc.dmp
CMDS=i~format
EXPECT=<<EOF
format   mdmp
EOF
RUN

NAME=mdmp info
FILE=bins/mdmp/calc.dmp
CMDS=iI
EXPECT=<<EOF
arch     x86
cpu      N/A
baddr    ----------
binsz    0x00008f74
bintype  mdmp
bits     64
retguard false
class    N/A
compiler N/A
dbg_file N/A
endian   LE
flags    0x00040000
hdr.csum 0x00000000
guid     N/A
intrp    N/A
laddr    0x00000000
lang     N/A
machine  AMD64
maxopsz  16
minopsz  1
os       Windows NT Workstation 6.1.7601
cc       N/A
pcalign  0
rpath    NONE
streams  13
subsys   
stripped false
crypto   false
havecode true
va       true
sanitiz  false
static   true
linenum  false
lsyms    false
canary   false
PIE      false
RELROCS  false
NX       false
EOF
RUN

NAME=mdmp sections
FILE=bins/mdmp/calc.dmp
CMDS=iS
EXPECT=<<EOF
paddr      size     vaddr         vsize    align perm name                                  type flags 
-------------------------------------------------------------------------------------------------------
0x00000000 0xe3000  0xfffe0000    0xe3000  0x0   ---- C:_Windows_System32_calc.exe               
0x00000000 0x1aa000 0x77720000    0x1aa000 0x0   ---- C:_Windows_System32__tdll.dll              
0x00000000 0x11f000 0x77500000    0x11f000 0x0   ---- C:_Windows_System32_kernel32.dll           
0x00000000 0x6a000  0x7fefd4a0000 0x6a000  0x0   ---- C:_Windows_System32_KERNELBASE.dll         
0x00000000 0xd8a000 0x7fefeca0000 0xd8a000 0x0   ---- C:_Windows_System32_shell32.dll            
0x00000000 0x9f000  0x7fefdab0000 0x9f000  0x0   ---- C:_Windows_System32_msvcrt.dll             
0x00000000 0x71000  0x7fefd890000 0x71000  0x0   ---- C:_Windows_System32_shlwapi.dll            
0x00000000 0x67000  0x7fefdb50000 0x67000  0x0   ---- C:_Windows_System32_gdi32.dll              
0x00000000 0xfa000  0x77620000    0xfa000  0x0   ---- C:_Windows_System32_user32.dll             
0x00000000 0xe000   0x7fefdbc0000 0xe000   0x0   ---- C:_Windows_System32_lpk.dll                
0x00000000 0xca000  0x7fefe450000 0xca000  0x0   ---- C:_Windows_System32_usp10.dll              
0x00000000 0x203000 0x7fefea90000 0x203000 0x0   ---- C:_Windows_System32_ole32.dll              
0x00000000 0x12d000 0x7fefe8d0000 0x12d000 0x0   ---- C:_Windows_System32__pcrt4.dll             
0x00000000 0xdb000  0x7fefd9d0000 0xdb000  0x0   ---- C:_Windows_System32__dvapi32.dll           
0x00000000 0x1f000  0x7fefdff0000 0x1f000  0x0   ---- C:_Windows_System32_sechost.dll            
0x00000000 0xda000  0x7fefe520000 0xda000  0x0   ---- C:_Windows_System32_oleaut32.dll           
0x00000000 0x56000  0x7fefbb40000 0x56000  0x0   ---- C:_Windows_System32_uxtheme.dll            
0x00000000 0x3b000  0x7fefa140000 0x3b000  0x0   ---- C:_Windows_System32_winmm.dll              
0x00000000 0xc000   0x7fefc330000 0xc000   0x0   ---- C:_Windows_System32__ersion.dll            
0x00000000 0x2e000  0x7fefea00000 0x2e000  0x0   ---- C:_Windows_System32_imm32.dll              
0x00000000 0x109000 0x7fefe340000 0x109000 0x0   ---- C:_Windows_System32_msctf.dll              
0x00000000 0x161000 0x7fefb560000 0x161000 0x0   ---- C:_Windows_System32_WindowsCodecs.dll      
0x00000000 0x18000  0x7fefb710000 0x18000  0x0   ---- C:_Windows_System32_dwmapi.dll             
0x00000000 0xf000   0x7fefd2b0000 0xf000   0x0   ---- C:_Windows_System32_CRYPTBASE.dll          
0x00000000 0x99000  0x7fefddb0000 0x99000  0x0   ---- C:_Windows_System32_clbcatq.dll            
0x00000000 0x54000  0x7fef62b0000 0x54000  0x0   ---- C:_Windows_System32_oleacc.dll             
EOF
RUN

NAME=mdmp maps
FILE=bins/mdmp/calc.dmp
CMDS=oml
EXPECT=<<EOF
 1 fd: 3 +0x000043ac 0x0398f9b8 - 0x0398ffff r-- fmap.memory.0x398f9b8
 2 fd: 3 +0x000049f4 0x77639dea - 0x77639ee9 r-- fmap.memory.0x77639dea
 3 fd: 3 +0x00004af4 0x032cf638 - 0x032cffff r-- fmap.memory.0x32cf638
 4 fd: 3 +0x000054bc 0x0367f868 - 0x0367ffff r-- fmap.memory.0x367f868
 5 fd: 3 +0x00005c54 0x000bd0d8 - 0x000bffff r-- fmap.memory.0xbd0d8
 6 fd: 3 +0x00008b7c 0x03a7ff08 - 0x03a7ffff r-- fmap.memory.0x3a7ff08
 7 fd: 3 +0x00008c74 0x7776ad90 - 0x7776ae8f r-- fmap.memory.0x7776ad90
 8 fd: 3 +0x00008d74 0x7776bafa - 0x7776bbf9 r-- fmap.memory.0x7776bafa
 9 fd: 3 +0x00008e74 0x7776c06a - 0x7776c169 r-- fmap.memory.0x7776c06a
EOF
RUN

NAME=mdmp memory64 maps
FILE=bins/mdmp/hello64.dmp
CMDS=oml
EXPECT=<<EOF
 1 fd: 3 +0x00002c8f 0x00010000 - 0x0001ffff r-- fmap.memory64.0x10000
 2 fd: 3 +0x00012c8f 0x00020000 - 0x0002ffff r-- fmap.memory64.0x20000
 3 fd: 3 +0x00022c8f 0x0022d000 - 0x0022ffff r-- fmap.memory64.0x22d000
 4 fd: 3 +0x00025c8f 0x00230000 - 0x00233fff r-- fmap.memory64.0x230000
 5 fd: 3 +0x00029c8f 0x00240000 - 0x00240fff r-- fmap.memory64.0x240000
 6 fd: 3 +0x0002ac8f 0x00250000 - 0x00250fff r-- fmap.memory64.0x250000
 7 fd: 3 +0x0002bc8f 0x00260000 - 0x002c6fff r-- fmap.memory64.0x260000
 8 fd: 3 +0x00092c8f 0x00400000 - 0x00400fff r-- fmap.memory64.0x400000
 9 fd: 3 +0x00093c8f 0x00401000 * 0x00402fff r-x fmap.memory64.0x401000
10 fd: 3 +0x00095c8f 0x00403000 - 0x00403fff r-- fmap.memory64.0x403000
11 fd: 3 +0x00096c8f 0x00404000 - 0x00406fff r-- fmap.memory64.0x404000
12 fd: 3 +0x00099c8f 0x00407000 - 0x00408fff r-- fmap.memory64.0x407000
13 fd: 3 +0x0009bc8f 0x00409000 - 0x0040bfff --- fmap.memory64.0x409000
14 fd: 3 +0x0009ec8f 0x0040c000 - 0x00424fff r-- fmap.memory64.0x40c000
15 fd: 3 +0x000b7c8f 0x00580000 - 0x00584fff r-- fmap.memory64.0x580000
16 fd: 3 +0x000bcc8f 0x005e0000 - 0x005e6fff r-- fmap.memory64.0x5e0000
17 fd: 3 +0x000c3c8f 0x77500000 - 0x77500fff r-- fmap.memory64.0x77500000
18 fd: 3 +0x000c4c8f 0x77501000 - 0x7759bfff r-x fmap.memory64.0x77501000
19 fd: 3 +0x0015fc8f 0x7759c000 - 0x77609fff r-- fmap.memory64.0x7759c000
20 fd: 3 +0x001cdc8f 0x7760a000 - 0x7760bfff r-- fmap.memory64.0x7760a000
21 fd: 3 +0x001cfc8f 0x7760c000 - 0x7761efff r-- fmap.memory64.0x7760c000
22 fd: 3 +0x001e2c8f 0x77720000 - 0x77720fff r-- fmap.memory64.0x77720000
23 fd: 3 +0x001e3c8f 0x77721000 - 0x7781dfff r-x fmap.memory64.0x77721000
24 fd: 3 +0x002e0c8f 0x7781e000 - 0x7784cfff r-- fmap.memory64.0x7781e000
25 fd: 3 +0x0030fc8f 0x7784d000 - 0x7784dfff r-- fmap.memory64.0x7784d000
26 fd: 3 +0x00310c8f 0x7784e000 - 0x7784efff --- fmap.memory64.0x7784e000
27 fd: 3 +0x00311c8f 0x7784f000 - 0x7784ffff r-- fmap.memory64.0x7784f000
28 fd: 3 +0x00312c8f 0x77850000 - 0x77851fff --- fmap.memory64.0x77850000
29 fd: 3 +0x00314c8f 0x77852000 - 0x77852fff r-- fmap.memory64.0x77852000
30 fd: 3 +0x00315c8f 0x77853000 - 0x77855fff --- fmap.memory64.0x77853000
31 fd: 3 +0x00318c8f 0x77856000 - 0x77857fff r-- fmap.memory64.0x77856000
32 fd: 3 +0x0031ac8f 0x77858000 - 0x77858fff --- fmap.memory64.0x77858000
33 fd: 3 +0x0031bc8f 0x77859000 - 0x7785afff r-- fmap.memory64.0x77859000
34 fd: 3 +0x0031dc8f 0x7785b000 - 0x778c9fff r-- fmap.memory64.0x7785b000
35 fd: 3 +0x0038cc8f 0x7efe0000 - 0x7efe4fff r-- fmap.memory64.0x7efe0000
36 fd: 3 +0x00391c8f 0x7ffe0000 - 0x7ffe0fff r-- fmap.memory64.0x7ffe0000
37 fd: 3 +0x00392c8f 0x7fefd4a0000 - 0x7fefd4a0fff r-- fmap.memory64.0x7fefd4a0000
38 fd: 3 +0x00393c8f 0x7fefd4a1000 - 0x7fefd4e9fff r-x fmap.memory64.0x7fefd4a1000
39 fd: 3 +0x003dcc8f 0x7fefd4ea000 - 0x7fefd4fefff r-- fmap.memory64.0x7fefd4ea000
40 fd: 3 +0x003f1c8f 0x7fefd4ff000 - 0x7fefd500fff r-- fmap.memory64.0x7fefd4ff000
41 fd: 3 +0x003f3c8f 0x7fefd501000 - 0x7fefd509fff r-- fmap.memory64.0x7fefd501000
42 fd: 3 +0x003fcc8f 0x7fefdab0000 - 0x7fefdab0fff r-- fmap.memory64.0x7fefdab0000
43 fd: 3 +0x003fdc8f 0x7fefdab1000 - 0x7fefdb29fff r-x fmap.memory64.0x7fefdab1000
44 fd: 3 +0x00476c8f 0x7fefdb2a000 - 0x7fefdb40fff r-- fmap.memory64.0x7fefdb2a000
45 fd: 3 +0x0048dc8f 0x7fefdb41000 - 0x7fefdb42fff r-- fmap.memory64.0x7fefdb41000
46 fd: 3 +0x0048fc8f 0x7fefdb43000 - 0x7fefdb43fff --- fmap.memory64.0x7fefdb43000
47 fd: 3 +0x00490c8f 0x7fefdb44000 - 0x7fefdb44fff r-- fmap.memory64.0x7fefdb44000
48 fd: 3 +0x00491c8f 0x7fefdb45000 - 0x7fefdb46fff --- fmap.memory64.0x7fefdb45000
49 fd: 3 +0x00493c8f 0x7fefdb47000 - 0x7fefdb4efff r-- fmap.memory64.0x7fefdb47000
50 fd: 3 +0x0049bc8f 0x7feffa40000 - 0x7feffa40fff r-- fmap.memory64.0x7feffa40000
51 fd: 3 +0x0049cc8f 0x7fffffb0000 - 0x7fffffd2fff r-- fmap.memory64.0x7fffffb0000
52 fd: 3 +0x004bfc8f 0x7fffffd7000 - 0x7fffffd7fff r-- fmap.memory64.0x7fffffd7000
53 fd: 3 +0x004c0c8f 0x7fffffde000 - 0x7fffffdffff r-- fmap.memory64.0x7fffffde000
EOF
RUN

NAME=mdmp entrypoints nomem .dmp
FILE=bins/mdmp/calc.dmp
CMDS=ie
EXPECT=<<EOF
vaddr paddr hvaddr haddr type 
------------------------------
EOF
RUN

NAME=mdmp resolve vaddr to paddr
FILE=bins/mdmp/hello.dmp
CMDS=px 64 @ 0x00400000
EXPECT=<<EOF
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00400000  4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............
0x00400010  b800 0000 0000 0000 4000 0000 0000 0000  ........@.......
0x00400020  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x00400030  0000 0000 0000 0000 0000 0000 8000 0000  ................
EOF
RUN

NAME=mdmp test format definitions
FILE=bins/mdmp/hello.dmp
ARGS=-nn
CMDS=pfn~mdmp
EXPECT=<<EOF
mdmp_directory "[4]E? (mdmp_stream_type)StreamType (mdmp_location_descriptor)Location"
mdmp_location_descriptor64 "qq DataSize RVA"
mdmp_exception_stream "dd?? ThreadId __Alignment (mdmp_exception)ExceptionRecord (mdmp_location_descriptor)ThreadContext"
mdmp_header "[4]zddddt[8]B Signature Version NumberOfStreams StreamDirectoryRVA CheckSum TimeDateStamp (mdmp_type)Flags"
mdmp_token_info "ddq TokenSize TokenId TokenHandle"
mdmp_memory_info_list "ddq[127]? SizeOfHeader SizeOfEntry NumberOfEntries (mdmp_memory_info)MemoryInfo"
mdmp_memory64_list "qq[83]? NumberOfMemoryRanges BaseRva (mdmp_memory_descriptor64)MemoryRanges"
mdmp_exception "[4]E[4]Eqqdd[15]q (mdmp_exception_code)ExceptionCode (mdmp_exception_flags)ExceptionFlags ExceptionRecord ExceptionAddress NumberParameters __UnusedAlignment ExceptionInformation"
mdmp_memory_descriptor "q? StartOfMemoryRange (mdmp_location_descriptor)Memory"
mdmp_thread_list "d[1]? NumberOfThreads (mdmp_thread)Threads"
mdmp_string "dZ Length Buffer"
mdmp_system_info "[2]EwwbBddd[4]Ed[2]Ew[2]q (mdmp_processor_architecture)ProcessorArchitecture ProcessorLevel ProcessorRevision NumberOfProcessors (mdmp_product_type)ProductType MajorVersion MinorVersion BuildNumber (mdmp_platform_id)PlatformId CsdVersionRva (mdmp_suite_mask)SuiteMask Reserved2 ProcessorFeatures"
mdmp_vs_fixedfileinfo "ddddddddddddd dwSignature dwStrucVersion dwFileVersionMs dwFileVersionLs dwProductVersionMs dwProductVersionLs dwFileFlagsMask dwFileFlags dwFileOs dwFileType dwFileSubtype dwFileDateMs dwFileDateLs"
mdmp_misc_info "d[4]Bdtttddddd SizeOfInfo (mdmp_misc1_flags)Flags1 ProcessId ProcessCreateTime ProcessUserTime ProcessKernelTime ProcessorMaxMhz ProcessorCurrentMhz ProcessorMhzLimit ProcessorMaxIdleState ProcessorCurrentIdleState"
mdmp_memory_descriptor64 "qq StartOfMemoryRange DataSize"
mdmp_module_list "d[10]? NumberOfModule (mdmp_module)Modules"
mdmp_token_info_list "dddd TokenListSize TokenListEntries ListHeaderSize ElementHeaderSize"
mdmp_module "qddtd???qq BaseOfImage SizeOfImage CheckSum TimeDateStamp ModuleNameRVA (mdmp_vs_fixedfileinfo)VersionInfo (mdmp_location_descriptor)CvRecord (mdmp_location_descriptor)MiscRecord Reserved0 Reserved1"
mdmp_location_descriptor "dd DataSize RVA"
mdmp_memory_info "qq[4]Edq[4]E[4]E[4]Ed BaseAddress AllocationBase (mdmp_page_protect)AllocationProtect __Alignment1 RegionSize (mdmp_mem_state)State (mdmp_page_protect)Protect (mdmp_mem_type)Type __Alignment2"
mdmp_thread "ddddq?? ThreadId SuspendCount PriorityClass Priority Teb (mdmp_memory_descriptor)Stack (mdmp_location_descriptor)ThreadContext"
EOF
RUN

NAME=mdmp 32bit - libraries count
FILE=bins/mdmp/hello.dmp
CMDS=il:quiet~?
EXPECT=<<EOF
57
EOF
RUN

NAME=mdmp 32bit - libraries resolving
FILE=bins/mdmp/hello.dmp
CMDS=il~kernel32.dll
EXPECT=<<EOF
[0x00400000] - kernel32.dll
EOF
RUN

NAME=mdmp 32bit - entrypoints count
FILE=bins/mdmp/hello.dmp
CMDS=<<EOF
ie:quiet~?
iee:quiet~?
EOF
EXPECT=<<EOF
9
2
EOF
RUN

NAME=mdmp 32bit - entrypoints resolving
FILE=bins/mdmp/hello.dmp
CMDS=ie~0x004014e0
EXPECT=<<EOF
0x004014e0 0x000990b2 ---------- 0x00097c7a program
EOF
RUN

NAME=mdmp 32bit - symbols count
FILE=bins/mdmp/hello.dmp
CMDS=is~?
EXPECT=<<EOF
7468
EOF
RUN

NAME=mdmp 32bit - symbols resolving 1
FILE=bins/mdmp/hello.dmp
CMDS=is~DeleteCriticalSection:0
EXPECT=<<EOF
1    0x0009dcda 0x00406108 NONE   FUNC 0    KERNEL32.dll                                  imp.DeleteCriticalSection
EOF
RUN

NAME=mdmp 32bit - symbols resolving 2
FILE=bins/mdmp/hello.dmp
CMDS=is~RtlDeleteCriticalSection:0
EXPECT=<<EOF
358  0x001c2176 0x76fb05a4 NONE   FUNC 0    ntdll.dll                                     imp.RtlDeleteCriticalSection
EOF
RUN

NAME=mdmp 32bit - imports count
FILE=bins/mdmp/hello.dmp
CMDS=ii~?
EXPECT=<<EOF
2030
EOF
RUN

NAME=mdmp 32bit - imports resolving
FILE=bins/mdmp/hello.dmp
CMDS=ii~TerminateProcess~KERNEL32.dll
EXPECT=<<EOF
17  0x00406148 NONE FUNC KERNEL32.dll                                  TerminateProcess
EOF
RUN

NAME=mdmp 32bit - exports count
FILE=bins/mdmp/hello.dmp
CMDS=iE~?
EXPECT=<<EOF
5440
EOF
RUN

NAME=mdmp 32bit - exports resolving
FILE=bins/mdmp/hello.dmp
CMDS=iE~Ordinal_1
EXPECT=<<EOF
1    0x0041f1f2 0x77802620 GLOBAL FUNC 0    ntdll.dll      Ordinal_1
EOF
RUN

NAME=mdmp 32bit - relocs count
FILE=bins/mdmp/hello.dmp
CMDS=ir:quiet~?
EXPECT=<<EOF
2028
EOF
RUN

NAME=mdmp 32bit - relocs resolving
FILE=bins/mdmp/hello.dmp
CMDS=ir~__dllonexit
EXPECT=<<EOF
0x00406160 0x0009dd32 SET_32 msvcrt.dll___dllonexit
EOF
RUN

NAME=mdmp 32bit - relocs following
FILE=bins/mdmp/hello.dmp
CMDS=e asm.bytes=true;pd 12 @ [0x004061cc];
EXPECT=<<EOF
            ;-- vfprintf:
            0x773e7430      8bff           mov   edi, edi
            0x773e7432      55             push  rbp
            0x773e7433      8bec           mov   ebp, esp
            0x773e7435      ff7510         push  qword [rbp + 0x10]
            0x773e7438      6a00           push  0
            0x773e743a      ff750c         push  qword [rbp + 0xc]
            0x773e743d      ff7508         push  qword [rbp + 8]
            0x773e7440      68fdcc3777     push  0x7737ccfd
            0x773e7445      e800feffff     call  0x773e724a
            0x773e744a      83c414         add   esp, 0x14
            0x773e744d      5d             pop   rbp
            0x773e744e      c3             ret
EOF
RUN

NAME=mdmp 32bit - strings
FILE=bins/mdmp/hello.dmp
CMDS=<<EOF
iz~0x0043cf24[1,2,3,4,5,6,7,8]
iz~0x0043cf2e[1,2,3,4,5,6,7,8]
iz~0x0043cf38[1,2,3,4,5,6,7,8]
iz~0x00447247[1,2,3,4,5,6,7,8]
iz~0x0044726b[1,2,3,4,5,6,7,8]
iz~0x00447291[1,2,3,4,5,6,7,8]
iz~0x004472ac[1,2,3,4,5,6,7,8]
iz~0x0048acc8[1,2,3,4,5,6,7,8]
iz~0x0048b004[1,2,3,4,5,6,7,8]
iz~0x00168c38[1,2,3,4,5,6,7,8]
iz~0x00168f80[1,2,3,4,5,6,7,8]
iz~0x00128c38[1,2,3,4,5,6,7,8]
iz~0x00128fa8[1,2,3,4,5,6,7,8]
iz~0x000cdc38[1,2,3,4,5,6,7,8]
iz~0x000cdf84[1,2,3,4,5,6,7,8]
iz~0x00299106[1,2,3,4,5,6,7,8]
iz~0x001adff0[1,2,3,4,5,6,7,8]
iz~0x0033641a[1,2,3,4,5,6,7,8]
iz~0x00337f88[1,2,3,4,5,6,7,8]
EOF
EXPECT=<<EOF
0x0043cf24 0x77820352 4 10 C:_Windows_System32__tdll.dll utf16le Alpc
0x0043cf2e 0x7782035c 4 10 C:_Windows_System32__tdll.dll utf16le Pool
0x0043cf38 0x77820366 5 12 C:_Windows_System32__tdll.dll utf16le Timer
0x00447247 0x7782a675 35 36 C:_Windows_System32__tdll.dll ascii RtlFindActivationContextSectionGuid
0x0044726b 0x7782a699 37 38 C:_Windows_System32__tdll.dll ascii RtlFindActivationContextSectionString
0x00447291 0x7782a6bf 26 27 C:_Windows_System32__tdll.dll ascii RtlFindCharInUnicodeString
0x004472ac 0x7782a6da 16 17 C:_Windows_System32__tdll.dll ascii RtlFindClearBits
0x0048acc8 0x7786e0f6 15 32 C:_Windows_System32__tdll.dll utf16le VS_VERSION_INFO
0x0048b004 0x7786e432 11 24 C:_Windows_System32__tdll.dll utf16le VarFileInfo
0x00168c38 0x7500d066 15 32 C:_Windows_System32_wow64.dll utf16le VS_VERSION_INFO
0x00168f80 0x7500d3ae 11 24 C:_Windows_System32_wow64.dll utf16le VarFileInfo
0x00128c38 0x74fc9066 15 32 C:_Windows_System32_wow64win.dll utf16le VS_VERSION_INFO
0x00128fa8 0x74fc93d6 11 24 C:_Windows_System32_wow64win.dll utf16le VarFileInfo
0x000cdc38 0x74f66066 15 32 C:_Windows_System32_wow64cpu.dll utf16le VS_VERSION_INFO
0x000cdf84 0x74f663b2 11 24 C:_Windows_System32_wow64cpu.dll utf16le VarFileInfo
0x00299106 0x77378534 11 12 C:_Windows_SysWOW64_kernel32.dll ascii _vfprintf_l
0x001adff0 0x75d9341e 11 24 C:_Windows_SysWOW64_KERNELBASE.dll utf16le VarFileInfo
0x0033641a 0x77415848 39 40 C:_Windows_SysWOW64_msvcrt.dll ascii Assertion failed:
0x00337f88 0x774173b6 11 24 C:_Windows_SysWOW64_msvcrt.dll utf16le VarFileInfo
EOF
RUN

NAME=mdmp 64bit - libraries count
FILE=bins/mdmp/hello64.dmp
CMDS=il:quiet~?
EXPECT=<<EOF
49
EOF
RUN

NAME=mdmp 64bit - libraries resolving
FILE=bins/mdmp/hello64.dmp
CMDS=il~kernel32.dll
EXPECT=<<EOF
[0x00400000] - kernel32.dll
EOF
RUN

NAME=mdmp 64bit - entrypoints count
FILE=bins/mdmp/hello64.dmp
CMDS=ie:quiet~?
EXPECT=<<EOF
5
EOF
RUN

NAME=mdmp 64bit - entrypoints resolving
FILE=bins/mdmp/hello64.dmp
CMDS=ie~0x00401500
EXPECT=<<EOF
0x00401500    0x0009418f ---------- 0x00092d37 program
EOF
RUN

NAME=mdmp 64bit - symbols count
FILE=bins/mdmp/hello64.dmp
CMDS=is~?
EXPECT=<<EOF
6826
EOF
RUN

NAME=mdmp 64bit - symbols resolving 1
FILE=bins/mdmp/hello64.dmp
CMDS=is~imp.DeleteCriticalSection~KERNEL32.dll
EXPECT=<<EOF
1    0x0009ae8b 0x004081fc    NONE   FUNC 0    KERNEL32.dll                                  imp.DeleteCriticalSection
EOF
RUN

NAME=mdmp 64bit - symbols resolving 2
FILE=bins/mdmp/hello64.dmp
CMDS=is~A_SHAFinal
EXPECT=<<EOF
9    0x001eb87f 0x77728bf0    GLOBAL FUNC 0    ntdll.dll                                     A_SHAFinal
EOF
RUN

NAME=mdmp 64bit - imports count
FILE=bins/mdmp/hello64.dmp
CMDS=ii~?
EXPECT=<<EOF
1511
EOF
RUN

NAME=mdmp 64bit - imports resolving
FILE=bins/mdmp/hello64.dmp
CMDS=ii~KERNEL32.dll~GetCurrentProcessId
EXPECT=<<EOF
4   0x00408214    NONE FUNC KERNEL32.dll                                  GetCurrentProcessId
EOF
RUN

NAME=mdmp 64bit - exports count
FILE=bins/mdmp/hello64.dmp
CMDS=iE~?
EXPECT=<<EOF
5317
EOF
RUN

NAME=mdmp 64bit - exports resolving
FILE=bins/mdmp/hello64.dmp
CMDS=iE~CsrVerifyRegion
EXPECT=<<EOF
39   0x0029513f 0x777d24b0    GLOBAL FUNC 0    ntdll.dll      CsrVerifyRegion
EOF
RUN

NAME=mdmp 64bit - relocs count
FILE=bins/mdmp/hello64.dmp
CMDS=ir:quiet~?
EXPECT=<<EOF
1509
EOF
RUN

NAME=mdmp 64bit - relocs resolving
FILE=bins/mdmp/hello64.dmp
CMDS=ir~KERNEL32.dll_DeleteCriticalSection
EXPECT=<<EOF
0x004081fc    0x0009ae8b SET_64 KERNEL32.dll_DeleteCriticalSection
EOF
RUN

NAME=mdmp 64bit - relocs following
FILE=bins/mdmp/hello64.dmp
CMDS=e asm.bytes=true; pd 9 @ [0x004083ac];
EXPECT=<<EOF
            ;-- vfprintf:
            0x7fefdb0a1a4      4883ec38       sub   rsp, 0x38
            0x7fefdb0a1a8      4c89442420     mov   qword [rsp + 0x20], r8
            0x7fefdb0a1ad      4c8bc2         mov   r8, rdx
            0x7fefdb0a1b0      488bd1         mov   rdx, rcx
            0x7fefdb0a1b3      488d0dea7ffa.  lea   rcx, [0x7fefdab21a4]
            0x7fefdb0a1ba      4533c9         xor   r9d, r9d
            0x7fefdb0a1bd      e87efdffff     call  0x7fefdb09f40
            0x7fefdb0a1c2      4883c438       add   rsp, 0x38
            0x7fefdb0a1c6      c3             ret
EOF
RUN

NAME=mdmp 64bit - strings
FILE=bins/mdmp/hello64.dmp
TIMEOUT=2040
CMDS=<<EOF
iz~0x002e2fe1[1,2,3,4,5,6,7,8]
iz~0x002e2feb[1,2,3,4,5,6,7,8]
iz~0x002e2ff5[1,2,3,4,5,6,7,8]
iz~0x00330d85[1,2,3,4,5,6,7,8]
iz~0x003310c1[1,2,3,4,5,6,7,8]
iz~0x00161a37[1,2,3,4,5,6,7,8]
iz~0x00161c7f[1,2,3,4,5,6,7,8]
iz~0x00161dbf[1,2,3,4,5,6,7,8]
iz~0x001d9d45[1,2,3,4,5,6,7,8]
iz~0x001da0a5[1,2,3,4,5,6,7,8]
iz~0x003fad45[1,2,3,4,5,6,7,8]
iz~0x003fb0ad[1,2,3,4,5,6,7,8]
iz~0x00480857[1,2,3,4,5,6,7,8]
iz~0x004808c7[1,2,3,4,5,6,7,8]
iz~0x00499cf5[1,2,3,4,5,6,7,8]
iz~0x0049a045[1,2,3,4,5,6,7,8]
EOF
EXPECT=<<EOF
0x002e2fe1 0x77820352 4 10 C:_Windows_System32__tdll.dll utf16le Alpc
0x002e2feb 0x7782035c 4 10 C:_Windows_System32__tdll.dll utf16le Pool
0x002e2ff5 0x77820366 5 12 C:_Windows_System32__tdll.dll utf16le Timer
0x00330d85 0x7786e0f6 15 32 C:_Windows_System32__tdll.dll utf16le VS_VERSION_INFO
0x003310c1 0x7786e432 11 24 C:_Windows_System32__tdll.dll utf16le VarFileInfo
0x00161a37 0x7759dda8 7 16 C:_Windows_System32_kernel32.dll utf16le win.ini
0x00161c7f 0x7759dff0 20 42 C:_Windows_System32_kernel32.dll utf16le \Classes\Wow6432Node
0x00161dbf 0x7759e130 45 92 C:_Windows_System32_kernel32.dll utf16le \REGISTRY\USER\*\SOFTWARE\Classes\Wow6432Node
0x001d9d45 0x776160b6 15 32 C:_Windows_System32_kernel32.dll utf16le VS_VERSION_INFO
0x001da0a5 0x77616416 11 24 C:_Windows_System32_kernel32.dll utf16le VarFileInfo
0x003fad45 0x7fefd5080b6 15 32 C:_Windows_System32_KERNELBASE.dll utf16le VS_VERSION_INFO
0x003fb0ad 0x7fefd50841e 11 24 C:_Windows_System32_KERNELBASE.dll utf16le VarFileInfo
0x00480857 0x7fefdb33bc8 4 10 C:_Windows_System32_msvcrt.dll utf16le PATH
0x004808c7 0x7fefdb33c38 10 22 C:_Windows_System32_msvcrt.dll utf16le SystemRoot
0x00499cf5 0x7fefdb4d066 15 32 C:_Windows_System32_msvcrt.dll utf16le VS_VERSION_INFO
0x0049a045 0x7fefdb4d3b6 11 24 C:_Windows_System32_msvcrt.dll utf16le VarFileInfo
EOF
RUN

NAME=mdmp reload file
FILE=bins/mdmp/calc.dmp
CMDS=<<EOF
obR
echo ok
EOF
EXPECT=<<EOF
ok
EOF
RUN
