professor-hippo / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
0 stars 0 forks source link

Unable to produce a good vtypes file from dwarf on MacOS 10.9.3 #505

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Obtain dwarf from 10.9.3 system and convert it to ("Step 2")
2. Run convert.py on the converted file ("Step 3") to produce the vtypes file

What is the expected output? What do you see instead?

A functioning vtype file w/no errors from convert.py

What version of the product are you using? On what operating system?
2.3.1, Mac OS 10.9.3

Please provide any additional information below.

$ python ../../../../../../tools/mac/convert.py conv10.9.3.64bit.dwarfdump > 
dwarf.txt.conv.vtypes
Traceback (most recent call last):
  File "../../../../../../tools/mac/convert.py", line 660, in <module>
    main()
  File "../../../../../../tools/mac/convert.py", line 657, in main
    parse_dwarf()     
  File "../../../../../../tools/mac/convert.py", line 391, in parse_dwarf
    parser.feed_line(line)
  File "../../../../../../tools/mac/convert.py", line 126, in feed_line
    self.process_statement(**parsed)
  File "../../../../../../tools/mac/convert.py", line 264, in process_statement
    off = int(data['AT_data_member_location'])
KeyError: 'AT_data_member_location'

The source file can be found here: 

https://www.dropbox.com/s/smsio9ep5vwd0wo/conv10.9.3.64bit.dwarfdump

Original issue reported on code.google.com by tor.houg...@gmail.com on 26 Jun 2014 at 10:33

GoogleCodeExporter commented 9 years ago
Followed up via email. 

Original comment by michael.hale@gmail.com on 29 Jun 2014 at 5:16