NAME=mdmp open
FILE=bins/mdmp/calc.dmp
CMDS=i~format
EXPECT=<<EOF
format   mdmp
EOF
RUN

NAME=mdmp info
FILE=bins/mdmp/calc.dmp
CMDS=iI
EXPECT=<<EOF
arch     x86
cpu      N/A
features N/A
baddr    ----------
binsz    0x00008f74
bintype  mdmp
bits     64
retguard false
class    N/A
compiler N/A
dbg_file N/A
endian   LE
flags    0x00040000
hdr.csum 0x00000000
guid     N/A
intrp    N/A
laddr    0x00000000
lang     N/A
machine  AMD64
maxopsz  16
minopsz  1
os       Windows NT Workstation 6.1.7601
cc       N/A
pcalign  1
rpath    NONE
streams  13
subsys   
stripped false
crypto   false
havecode true
va       true
sanitiz  false
static   true
linenum  false
lsyms    false
canary   false
PIE      false
RELROCS  false
NX       false
EOF
RUN

NAME=mdmp sections
FILE=bins/mdmp/calc.dmp
CMDS=iS
EXPECT=<<EOF
     paddr     size         vaddr    vsize align perm name                                  type flags 
-------------------------------------------------------------------------------------------------------
0x00000000  0xe3000    0xfffe0000  0xe3000   0x0 ---- C:_Windows_System32_calc.exe               
0x00000000 0x1aa000    0x77720000 0x1aa000   0x0 ---- C:_Windows_System32__tdll.dll              
0x00000000 0x11f000    0x77500000 0x11f000   0x0 ---- C:_Windows_System32_kernel32.dll           
0x00000000  0x6a000 0x7fefd4a0000  0x6a000   0x0 ---- C:_Windows_System32_KERNELBASE.dll         
0x00000000 0xd8a000 0x7fefeca0000 0xd8a000   0x0 ---- C:_Windows_System32_shell32.dll            
0x00000000  0x9f000 0x7fefdab0000  0x9f000   0x0 ---- C:_Windows_System32_msvcrt.dll             
0x00000000  0x71000 0x7fefd890000  0x71000   0x0 ---- C:_Windows_System32_shlwapi.dll            
0x00000000  0x67000 0x7fefdb50000  0x67000   0x0 ---- C:_Windows_System32_gdi32.dll              
0x00000000  0xfa000    0x77620000  0xfa000   0x0 ---- C:_Windows_System32_user32.dll             
0x00000000   0xe000 0x7fefdbc0000   0xe000   0x0 ---- C:_Windows_System32_lpk.dll                
0x00000000  0xca000 0x7fefe450000  0xca000   0x0 ---- C:_Windows_System32_usp10.dll              
0x00000000 0x203000 0x7fefea90000 0x203000   0x0 ---- C:_Windows_System32_ole32.dll              
0x00000000 0x12d000 0x7fefe8d0000 0x12d000   0x0 ---- C:_Windows_System32__pcrt4.dll             
0x00000000  0xdb000 0x7fefd9d0000  0xdb000   0x0 ---- C:_Windows_System32__dvapi32.dll           
0x00000000  0x1f000 0x7fefdff0000  0x1f000   0x0 ---- C:_Windows_System32_sechost.dll            
0x00000000  0xda000 0x7fefe520000  0xda000   0x0 ---- C:_Windows_System32_oleaut32.dll           
0x00000000  0x56000 0x7fefbb40000  0x56000   0x0 ---- C:_Windows_System32_uxtheme.dll            
0x00000000  0x3b000 0x7fefa140000  0x3b000   0x0 ---- C:_Windows_System32_winmm.dll              
0x00000000   0xc000 0x7fefc330000   0xc000   0x0 ---- C:_Windows_System32__ersion.dll            
0x00000000  0x2e000 0x7fefea00000  0x2e000   0x0 ---- C:_Windows_System32_imm32.dll              
0x00000000 0x109000 0x7fefe340000 0x109000   0x0 ---- C:_Windows_System32_msctf.dll              
0x00000000 0x161000 0x7fefb560000 0x161000   0x0 ---- C:_Windows_System32_WindowsCodecs.dll      
0x00000000  0x18000 0x7fefb710000  0x18000   0x0 ---- C:_Windows_System32_dwmapi.dll             
0x00000000   0xf000 0x7fefd2b0000   0xf000   0x0 ---- C:_Windows_System32_CRYPTBASE.dll          
0x00000000  0x99000 0x7fefddb0000  0x99000   0x0 ---- C:_Windows_System32_clbcatq.dll            
0x00000000  0x54000 0x7fef62b0000  0x54000   0x0 ---- C:_Windows_System32_oleacc.dll             
EOF
RUN

NAME=mdmp maps
FILE=bins/mdmp/calc.dmp
CMDS=oml
EXPECT=<<EOF
 1 fd: 3 +0x000043ac 0x0398f9b8 - 0x0398ffff r-- fmap.memory.0x398f9b8
 2 fd: 3 +0x000049f4 0x77639dea - 0x77639ee9 r-- fmap.memory.0x77639dea
 3 fd: 3 +0x00004af4 0x032cf638 - 0x032cffff r-- fmap.memory.0x32cf638
 4 fd: 3 +0x000054bc 0x0367f868 - 0x0367ffff r-- fmap.memory.0x367f868
 5 fd: 3 +0x00005c54 0x000bd0d8 - 0x000bffff r-- fmap.memory.0xbd0d8
 6 fd: 3 +0x00008b7c 0x03a7ff08 - 0x03a7ffff r-- fmap.memory.0x3a7ff08
 7 fd: 3 +0x00008c74 0x7776ad90 - 0x7776ae8f r-- fmap.memory.0x7776ad90
 8 fd: 3 +0x00008d74 0x7776bafa - 0x7776bbf9 r-- fmap.memory.0x7776bafa
 9 fd: 3 +0x00008e74 0x7776c06a - 0x7776c169 r-- fmap.memory.0x7776c06a
EOF
RUN

NAME=mdmp memory64 maps
FILE=bins/mdmp/hello64.dmp
CMDS=oml
EXPECT=<<EOF
 1 fd: 3 +0x00002c8f 0x00010000 - 0x0001ffff r-- fmap.memory64.0x10000
 2 fd: 3 +0x00012c8f 0x00020000 - 0x0002ffff r-- fmap.memory64.0x20000
 3 fd: 3 +0x00022c8f 0x0022d000 - 0x0022ffff r-- fmap.memory64.0x22d000
 4 fd: 3 +0x00025c8f 0x00230000 - 0x00233fff r-- fmap.memory64.0x230000
 5 fd: 3 +0x00029c8f 0x00240000 - 0x00240fff r-- fmap.memory64.0x240000
 6 fd: 3 +0x0002ac8f 0x00250000 - 0x00250fff r-- fmap.memory64.0x250000
 7 fd: 3 +0x0002bc8f 0x00260000 - 0x002c6fff r-- fmap.memory64.0x260000
 8 fd: 3 +0x00092c8f 0x00400000 - 0x00400fff r-- fmap.memory64.0x400000
 9 fd: 3 +0x00093c8f 0x00401000 * 0x00402fff r-x fmap.memory64.0x401000
10 fd: 3 +0x00095c8f 0x00403000 - 0x00403fff r-- fmap.memory64.0x403000
11 fd: 3 +0x00096c8f 0x00404000 - 0x00406fff r-- fmap.memory64.0x404000
12 fd: 3 +0x00099c8f 0x00407000 - 0x00408fff r-- fmap.memory64.0x407000
13 fd: 3 +0x0009bc8f 0x00409000 - 0x0040bfff --- fmap.memory64.0x409000
14 fd: 3 +0x0009ec8f 0x0040c000 - 0x00424fff r-- fmap.memory64.0x40c000
15 fd: 3 +0x000b7c8f 0x00580000 - 0x00584fff r-- fmap.memory64.0x580000
16 fd: 3 +0x000bcc8f 0x005e0000 - 0x005e6fff r-- fmap.memory64.0x5e0000
17 fd: 3 +0x000c3c8f 0x77500000 - 0x77500fff r-- fmap.memory64.0x77500000
18 fd: 3 +0x000c4c8f 0x77501000 - 0x7759bfff r-x fmap.memory64.0x77501000
19 fd: 3 +0x0015fc8f 0x7759c000 - 0x77609fff r-- fmap.memory64.0x7759c000
20 fd: 3 +0x001cdc8f 0x7760a000 - 0x7760bfff r-- fmap.memory64.0x7760a000
21 fd: 3 +0x001cfc8f 0x7760c000 - 0x7761efff r-- fmap.memory64.0x7760c000
22 fd: 3 +0x001e2c8f 0x77720000 - 0x77720fff r-- fmap.memory64.0x77720000
23 fd: 3 +0x001e3c8f 0x77721000 - 0x7781dfff r-x fmap.memory64.0x77721000
24 fd: 3 +0x002e0c8f 0x7781e000 - 0x7784cfff r-- fmap.memory64.0x7781e000
25 fd: 3 +0x0030fc8f 0x7784d000 - 0x7784dfff r-- fmap.memory64.0x7784d000
26 fd: 3 +0x00310c8f 0x7784e000 - 0x7784efff --- fmap.memory64.0x7784e000
27 fd: 3 +0x00311c8f 0x7784f000 - 0x7784ffff r-- fmap.memory64.0x7784f000
28 fd: 3 +0x00312c8f 0x77850000 - 0x77851fff --- fmap.memory64.0x77850000
29 fd: 3 +0x00314c8f 0x77852000 - 0x77852fff r-- fmap.memory64.0x77852000
30 fd: 3 +0x00315c8f 0x77853000 - 0x77855fff --- fmap.memory64.0x77853000
31 fd: 3 +0x00318c8f 0x77856000 - 0x77857fff r-- fmap.memory64.0x77856000
32 fd: 3 +0x0031ac8f 0x77858000 - 0x77858fff --- fmap.memory64.0x77858000
33 fd: 3 +0x0031bc8f 0x77859000 - 0x7785afff r-- fmap.memory64.0x77859000
34 fd: 3 +0x0031dc8f 0x7785b000 - 0x778c9fff r-- fmap.memory64.0x7785b000
35 fd: 3 +0x0038cc8f 0x7efe0000 - 0x7efe4fff r-- fmap.memory64.0x7efe0000
36 fd: 3 +0x00391c8f 0x7ffe0000 - 0x7ffe0fff r-- fmap.memory64.0x7ffe0000
37 fd: 3 +0x00392c8f 0x7fefd4a0000 - 0x7fefd4a0fff r-- fmap.memory64.0x7fefd4a0000
38 fd: 3 +0x00393c8f 0x7fefd4a1000 - 0x7fefd4e9fff r-x fmap.memory64.0x7fefd4a1000
39 fd: 3 +0x003dcc8f 0x7fefd4ea000 - 0x7fefd4fefff r-- fmap.memory64.0x7fefd4ea000
40 fd: 3 +0x003f1c8f 0x7fefd4ff000 - 0x7fefd500fff r-- fmap.memory64.0x7fefd4ff000
41 fd: 3 +0x003f3c8f 0x7fefd501000 - 0x7fefd509fff r-- fmap.memory64.0x7fefd501000
42 fd: 3 +0x003fcc8f 0x7fefdab0000 - 0x7fefdab0fff r-- fmap.memory64.0x7fefdab0000
43 fd: 3 +0x003fdc8f 0x7fefdab1000 - 0x7fefdb29fff r-x fmap.memory64.0x7fefdab1000
44 fd: 3 +0x00476c8f 0x7fefdb2a000 - 0x7fefdb40fff r-- fmap.memory64.0x7fefdb2a000
45 fd: 3 +0x0048dc8f 0x7fefdb41000 - 0x7fefdb42fff r-- fmap.memory64.0x7fefdb41000
46 fd: 3 +0x0048fc8f 0x7fefdb43000 - 0x7fefdb43fff --- fmap.memory64.0x7fefdb43000
47 fd: 3 +0x00490c8f 0x7fefdb44000 - 0x7fefdb44fff r-- fmap.memory64.0x7fefdb44000
48 fd: 3 +0x00491c8f 0x7fefdb45000 - 0x7fefdb46fff --- fmap.memory64.0x7fefdb45000
49 fd: 3 +0x00493c8f 0x7fefdb47000 - 0x7fefdb4efff r-- fmap.memory64.0x7fefdb47000
50 fd: 3 +0x0049bc8f 0x7feffa40000 - 0x7feffa40fff r-- fmap.memory64.0x7feffa40000
51 fd: 3 +0x0049cc8f 0x7fffffb0000 - 0x7fffffd2fff r-- fmap.memory64.0x7fffffb0000
52 fd: 3 +0x004bfc8f 0x7fffffd7000 - 0x7fffffd7fff r-- fmap.memory64.0x7fffffd7000
53 fd: 3 +0x004c0c8f 0x7fffffde000 - 0x7fffffdffff r-- fmap.memory64.0x7fffffde000
EOF
RUN

NAME=mdmp entrypoints nomem .dmp
FILE=bins/mdmp/calc.dmp
CMDS=ie
EXPECT=<<EOF
vaddr paddr hvaddr haddr type 
------------------------------
EOF
RUN

NAME=mdmp resolve vaddr to paddr
FILE=bins/mdmp/hello.dmp
CMDS=px 64 @ 0x00400000
EXPECT=<<EOF
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00400000  4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............
0x00400010  b800 0000 0000 0000 4000 0000 0000 0000  ........@.......
0x00400020  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x00400030  0000 0000 0000 0000 0000 0000 8000 0000  ................
EOF
RUN

NAME=mdmp test format definitions
FILE=bins/mdmp/hello.dmp
ARGS=-nn
CMDS=pfn~mdmp
EXPECT=<<EOF
mdmp_directory "[4]E? (mdmp_stream_type)StreamType (mdmp_location_descriptor)Location"
mdmp_header "[4]zddddt[8]B Signature Version NumberOfStreams StreamDirectoryRVA CheckSum TimeDateStamp (mdmp_type)Flags"
mdmp_vs_fixedfileinfo "ddddddddddddd dwSignature dwStrucVersion dwFileVersionMs dwFileVersionLs dwProductVersionMs dwProductVersionLs dwFileFlagsMask dwFileFlags dwFileOs dwFileType dwFileSubtype dwFileDateMs dwFileDateLs"
mdmp_memory_info "qq[4]Edq[4]E[4]E[4]Ed BaseAddress AllocationBase (mdmp_page_protect)AllocationProtect __Alignment1 RegionSize (mdmp_mem_state)State (mdmp_page_protect)Protect (mdmp_mem_type)Type __Alignment2"
mdmp_location_descriptor "dd DataSize RVA"
mdmp_exception_stream "dd?? ThreadId __Alignment (mdmp_exception)ExceptionRecord (mdmp_location_descriptor)ThreadContext"
mdmp_memory_descriptor64 "qq StartOfMemoryRange DataSize"
mdmp_exception "[4]E[4]Eqqdd[15]q (mdmp_exception_code)ExceptionCode (mdmp_exception_flags)ExceptionFlags ExceptionRecord ExceptionAddress NumberParameters __UnusedAlignment ExceptionInformation"
mdmp_memory_descriptor "q? StartOfMemoryRange (mdmp_location_descriptor)Memory"
mdmp_thread_list "d[1]? NumberOfThreads (mdmp_thread)Threads"
mdmp_module_list "d[10]? NumberOfModule (mdmp_module)Modules"
mdmp_memory_info_list "ddq[127]? SizeOfHeader SizeOfEntry NumberOfEntries (mdmp_memory_info)MemoryInfo"
mdmp_token_info_list "dddd TokenListSize TokenListEntries ListHeaderSize ElementHeaderSize"
mdmp_thread "ddddq?? ThreadId SuspendCount PriorityClass Priority Teb (mdmp_memory_descriptor)Stack (mdmp_location_descriptor)ThreadContext"
mdmp_system_info "[2]EwwbBddd[4]Ed[2]Ew[2]q (mdmp_processor_architecture)ProcessorArchitecture ProcessorLevel ProcessorRevision NumberOfProcessors (mdmp_product_type)ProductType MajorVersion MinorVersion BuildNumber (mdmp_platform_id)PlatformId CsdVersionRva (mdmp_suite_mask)SuiteMask Reserved2 ProcessorFeatures"
mdmp_token_info "ddq TokenSize TokenId TokenHandle"
mdmp_memory64_list "qq[83]? NumberOfMemoryRanges BaseRva (mdmp_memory_descriptor64)MemoryRanges"
mdmp_location_descriptor64 "qq DataSize RVA"
mdmp_module "qddtd???qq BaseOfImage SizeOfImage CheckSum TimeDateStamp ModuleNameRVA (mdmp_vs_fixedfileinfo)VersionInfo (mdmp_location_descriptor)CvRecord (mdmp_location_descriptor)MiscRecord Reserved0 Reserved1"
mdmp_misc_info "d[4]Bdtttddddd SizeOfInfo (mdmp_misc1_flags)Flags1 ProcessId ProcessCreateTime ProcessUserTime ProcessKernelTime ProcessorMaxMhz ProcessorCurrentMhz ProcessorMhzLimit ProcessorMaxIdleState ProcessorCurrentIdleState"
mdmp_string "dZ Length Buffer"
EOF
RUN

NAME=mdmp 32bit - libraries count
FILE=bins/mdmp/hello.dmp
CMDS=il:quiet~?
EXPECT=<<EOF
57
EOF
RUN

NAME=mdmp 32bit - libraries resolving
FILE=bins/mdmp/hello.dmp
CMDS=il~kernel32.dll
EXPECT=<<EOF
[0x00400000] - kernel32.dll
EOF
RUN

NAME=mdmp 32bit - entrypoints count
FILE=bins/mdmp/hello.dmp
CMDS=<<EOF
ie:quiet~?
iee:quiet~?
EOF
EXPECT=<<EOF
11
2
EOF
RUN

NAME=mdmp 32bit - entrypoints resolving
FILE=bins/mdmp/hello.dmp
CMDS=ie~0x004014e0
EXPECT=<<EOF
0x004014e0 0x000990b2 ---------- 0x00097c7a program
EOF
RUN

NAME=mdmp 32bit - symbols count
FILE=bins/mdmp/hello.dmp
CMDS=is~?
EXPECT=<<EOF
7468
EOF
RUN

NAME=mdmp 32bit - symbols resolving 1
FILE=bins/mdmp/hello.dmp
CMDS=is~DeleteCriticalSection:0
EXPECT=<<EOF
   1 0x0009dcda 0x00406108 NONE   FUNC    0 KERNEL32.dll                                  imp.DeleteCriticalSection
EOF
RUN

NAME=mdmp 32bit - symbols resolving 2
FILE=bins/mdmp/hello.dmp
CMDS=is~RtlDeleteCriticalSection:0
EXPECT=<<EOF
 358 0x001c2176 0x76fb05a4 NONE   FUNC    0 ntdll.dll                                     imp.RtlDeleteCriticalSection
EOF
RUN

NAME=mdmp 32bit - imports count
FILE=bins/mdmp/hello.dmp
CMDS=ii~?
EXPECT=<<EOF
2030
EOF
RUN

NAME=mdmp 32bit - imports resolving
FILE=bins/mdmp/hello.dmp
CMDS=ii~TerminateProcess~KERNEL32.dll
EXPECT=<<EOF
 17 0x00406148 NONE FUNC KERNEL32.dll                                  TerminateProcess
EOF
RUN

NAME=mdmp 32bit - exports count
FILE=bins/mdmp/hello.dmp
CMDS=iE~?
EXPECT=<<EOF
5440
EOF
RUN

NAME=mdmp 32bit - exports resolving
FILE=bins/mdmp/hello.dmp
CMDS=iE~Ordinal_1
EXPECT=<<EOF
   1 0x0041f1f2 0x77802620 GLOBAL FUNC    0 ntdll.dll      Ordinal_1
EOF
RUN

NAME=mdmp 32bit - strings
FILE=bins/mdmp/hello.dmp
CMDS=<<EOF
iz~0x0043cf24[1,2,3,4,5,6,7,8]
iz~0x0043cf2e[1,2,3,4,5,6,7,8]
iz~0x0043cf38[1,2,3,4,5,6,7,8]
iz~0x00447247[1,2,3,4,5,6,7,8]
iz~0x0044726b[1,2,3,4,5,6,7,8]
iz~0x00447291[1,2,3,4,5,6,7,8]
iz~0x004472ac[1,2,3,4,5,6,7,8]
iz~0x0048acc8[1,2,3,4,5,6,7,8]
iz~0x0048b004[1,2,3,4,5,6,7,8]
iz~0x00168c38[1,2,3,4,5,6,7,8]
iz~0x00168f80[1,2,3,4,5,6,7,8]
iz~0x00128c38[1,2,3,4,5,6,7,8]
iz~0x00128fa8[1,2,3,4,5,6,7,8]
iz~0x000cdc38[1,2,3,4,5,6,7,8]
iz~0x000cdf84[1,2,3,4,5,6,7,8]
iz~0x00299106[1,2,3,4,5,6,7,8]
iz~0x001adff0[1,2,3,4,5,6,7,8]
iz~0x0033641a[1,2,3,4,5,6,7,8]
iz~0x00337f88[1,2,3,4,5,6,7,8]
EOF
EXPECT=<<EOF
0x0043cf24 0x77820352 4 10 C:_Windows_System32__tdll.dll utf16le Alpc
0x0043cf2e 0x7782035c 4 10 C:_Windows_System32__tdll.dll utf16le Pool
0x0043cf38 0x77820366 5 12 C:_Windows_System32__tdll.dll utf16le Timer
0x00447247 0x7782a675 35 36 C:_Windows_System32__tdll.dll ascii RtlFindActivationContextSectionGuid
0x0044726b 0x7782a699 37 38 C:_Windows_System32__tdll.dll ascii RtlFindActivationContextSectionString
0x00447291 0x7782a6bf 26 27 C:_Windows_System32__tdll.dll ascii RtlFindCharInUnicodeString
0x004472ac 0x7782a6da 16 17 C:_Windows_System32__tdll.dll ascii RtlFindClearBits
0x0048acc8 0x7786e0f6 15 32 C:_Windows_System32__tdll.dll utf16le VS_VERSION_INFO
0x0048b004 0x7786e432 11 24 C:_Windows_System32__tdll.dll utf16le VarFileInfo
0x00168c38 0x7500d066 15 32 C:_Windows_System32_wow64.dll utf16le VS_VERSION_INFO
0x00168f80 0x7500d3ae 11 24 C:_Windows_System32_wow64.dll utf16le VarFileInfo
0x00128c38 0x74fc9066 15 32 C:_Windows_System32_wow64win.dll utf16le VS_VERSION_INFO
0x00128fa8 0x74fc93d6 11 24 C:_Windows_System32_wow64win.dll utf16le VarFileInfo
0x000cdc38 0x74f66066 15 32 C:_Windows_System32_wow64cpu.dll utf16le VS_VERSION_INFO
0x000cdf84 0x74f663b2 11 24 C:_Windows_System32_wow64cpu.dll utf16le VarFileInfo
0x00299106 0x77378534 11 12 C:_Windows_SysWOW64_kernel32.dll ascii _vfprintf_l
0x001adff0 0x75d9341e 11 24 C:_Windows_SysWOW64_KERNELBASE.dll utf16le VarFileInfo
0x0033641a 0x77415848 39 40 C:_Windows_SysWOW64_msvcrt.dll ascii Assertion failed:
0x00337f88 0x774173b6 11 24 C:_Windows_SysWOW64_msvcrt.dll utf16le VarFileInfo
EOF
RUN

NAME=mdmp 64bit - libraries count
FILE=bins/mdmp/hello64.dmp
CMDS=il:quiet~?
EXPECT=<<EOF
49
EOF
RUN

NAME=mdmp 64bit - libraries resolving
FILE=bins/mdmp/hello64.dmp
CMDS=il~kernel32.dll
EXPECT=<<EOF
[0x00400000] - kernel32.dll
EOF
RUN

NAME=mdmp 64bit - entrypoints count
FILE=bins/mdmp/hello64.dmp
CMDS=ie:quiet~?
EXPECT=<<EOF
5
EOF
RUN

NAME=mdmp 64bit - entrypoints resolving
FILE=bins/mdmp/hello64.dmp
CMDS=ie~0x00401500
EXPECT=<<EOF
   0x00401500 0x0009418f ---------- 0x00092d37 program
EOF
RUN

NAME=mdmp 64bit - symbols count
FILE=bins/mdmp/hello64.dmp
CMDS=is~?
EXPECT=<<EOF
6826
EOF
RUN

NAME=mdmp 64bit - symbols resolving 1
FILE=bins/mdmp/hello64.dmp
CMDS=is~imp.DeleteCriticalSection~KERNEL32.dll
EXPECT=<<EOF
   1 0x0009ae8b    0x004081fc NONE   FUNC    0 KERNEL32.dll                                  imp.DeleteCriticalSection
EOF
RUN

NAME=mdmp 64bit - symbols resolving 2
FILE=bins/mdmp/hello64.dmp
CMDS=is~A_SHAFinal
EXPECT=<<EOF
   9 0x001eb87f    0x77728bf0 GLOBAL FUNC    0 ntdll.dll                                     A_SHAFinal
EOF
RUN

NAME=mdmp 64bit - imports count
FILE=bins/mdmp/hello64.dmp
CMDS=ii~?
EXPECT=<<EOF
1511
EOF
RUN

NAME=mdmp 64bit - imports resolving
FILE=bins/mdmp/hello64.dmp
CMDS=ii~KERNEL32.dll~GetCurrentProcessId
EXPECT=<<EOF
  4    0x00408214 NONE FUNC KERNEL32.dll                                  GetCurrentProcessId
EOF
RUN

NAME=mdmp 64bit - exports count
FILE=bins/mdmp/hello64.dmp
CMDS=iE~?
EXPECT=<<EOF
5317
EOF
RUN

NAME=mdmp 64bit - exports resolving
FILE=bins/mdmp/hello64.dmp
CMDS=iE~CsrVerifyRegion
EXPECT=<<EOF
  39 0x0029513f    0x777d24b0 GLOBAL FUNC    0 ntdll.dll      CsrVerifyRegion
EOF
RUN

NAME=mdmp 64bit - strings
FILE=bins/mdmp/hello64.dmp
TIMEOUT=2040
CMDS=<<EOF
iz~0x002e2fe1[1,2,3,4,5,6,7,8]
iz~0x002e2feb[1,2,3,4,5,6,7,8]
iz~0x002e2ff5[1,2,3,4,5,6,7,8]
iz~0x00330d85[1,2,3,4,5,6,7,8]
iz~0x003310c1[1,2,3,4,5,6,7,8]
iz~0x00161a37[1,2,3,4,5,6,7,8]
iz~0x00161c7f[1,2,3,4,5,6,7,8]
iz~0x00161dbf[1,2,3,4,5,6,7,8]
iz~0x001d9d45[1,2,3,4,5,6,7,8]
iz~0x001da0a5[1,2,3,4,5,6,7,8]
iz~0x003fad45[1,2,3,4,5,6,7,8]
iz~0x003fb0ad[1,2,3,4,5,6,7,8]
iz~0x00480857[1,2,3,4,5,6,7,8]
iz~0x004808c7[1,2,3,4,5,6,7,8]
iz~0x00499cf5[1,2,3,4,5,6,7,8]
iz~0x0049a045[1,2,3,4,5,6,7,8]
EOF
EXPECT=<<EOF
0x002e2fe1 0x77820352 4 10 C:_Windows_System32__tdll.dll utf16le Alpc
0x002e2feb 0x7782035c 4 10 C:_Windows_System32__tdll.dll utf16le Pool
0x002e2ff5 0x77820366 5 12 C:_Windows_System32__tdll.dll utf16le Timer
0x00330d85 0x7786e0f6 15 32 C:_Windows_System32__tdll.dll utf16le VS_VERSION_INFO
0x003310c1 0x7786e432 11 24 C:_Windows_System32__tdll.dll utf16le VarFileInfo
0x00161a37 0x7759dda8 7 16 C:_Windows_System32_kernel32.dll utf16le win.ini
0x00161c7f 0x7759dff0 20 42 C:_Windows_System32_kernel32.dll utf16le \Classes\Wow6432Node
0x00161dbf 0x7759e130 45 92 C:_Windows_System32_kernel32.dll utf16le \REGISTRY\USER\*\SOFTWARE\Classes\Wow6432Node
0x001d9d45 0x776160b6 15 32 C:_Windows_System32_kernel32.dll utf16le VS_VERSION_INFO
0x001da0a5 0x77616416 11 24 C:_Windows_System32_kernel32.dll utf16le VarFileInfo
0x003fad45 0x7fefd5080b6 15 32 C:_Windows_System32_KERNELBASE.dll utf16le VS_VERSION_INFO
0x003fb0ad 0x7fefd50841e 11 24 C:_Windows_System32_KERNELBASE.dll utf16le VarFileInfo
0x00480857 0x7fefdb33bc8 4 10 C:_Windows_System32_msvcrt.dll utf16le PATH
0x004808c7 0x7fefdb33c38 10 22 C:_Windows_System32_msvcrt.dll utf16le SystemRoot
0x00499cf5 0x7fefdb4d066 15 32 C:_Windows_System32_msvcrt.dll utf16le VS_VERSION_INFO
0x0049a045 0x7fefdb4d3b6 11 24 C:_Windows_System32_msvcrt.dll utf16le VarFileInfo
EOF
RUN

NAME=mdmp reload file
FILE=bins/mdmp/calc.dmp
CMDS=<<EOF
obR
echo ok
EOF
EXPECT=<<EOF
ok
EOF
RUN
