search

volatilityfoundation / dwarf2json

convert ELF/DWARF symbol and type information into vol3's intermediate JSON
Other
104 stars 28 forks source link

No user types being generated when using System map + dwarf #19

Closed richsurgenor closed 3 years ago

richsurgenor commented 4 years ago

Dwarf was generated using vol2's tools/linux.

Using Ubuntu 18.

If I use vmlinux it works but shouldn't just a dwarf and map be enough?

Command issued" ./dwarf2json linux --system-map System.map-4.15.0-106-generic module.dwarf > output.json

I have included an upload to the files: dwarf_and_map.zip

ilch1 commented 4 years ago

Hi @richsurgenor,

Thank you for submitting the issue.

The current master does not fully support creating symbols for Linux without a debug kernel. There is ongoing work in trying to add that functionality, see #12.

The likely reason that user types were not included in your output is that you did not provide the --elf-types flag with the DWARF file in the command. Also, the dwarf file in the zip is ASCII and looks like the output of dwarfdump or some other tool. You would need to pass an ELF file that contains DWARF debug information (i.e., the actual linux module ko file).

richsurgenor commented 4 years ago

Hi, thanks for responding. So I either need a dbg kernel or a kernel module, but the actual dwarf+system map doesn't get you everything you need I guess?

ilch1 commented 4 years ago

Yes, that is correct.

ilch1 commented 3 years ago

Closing issue. Please re-open if you have further questions.