search

volatilityfoundation / dwarf2json

convert ELF/DWARF symbol and type information into vol3's intermediate JSON
Other
106 stars 28 forks source link

openSUSE Tumbleweed: decoding dwarf section underflow failure #24

Closed frispete closed 3 years ago

frispete commented 4 years ago

An attempt to create a full profile for the Linux 5.8.0 kernel on openSUSE Tumbleweed fails with:

$ dwarf2json linux --elf /usr/lib/debug/boot/vmlinux-5.8.0-1-default.debug > 5.8.0-1-default.json
Failed linux processing: could not get DWARF from /usr/lib/debug/boot/vmlinux-5.8.0-1-default.debug: decoding dwarf section info at offset 0x2705: underflow

OTOH, a pure symbol mapping succeeds:

$ dwarf2json linux --system-map /boot/System.map-5.8.0-1-default > 5.8.0-1-default-syms.json

If you want to reproduce the issue, fetch the kernel debug package from here. The filename might change in case of new releases (as being expected). You should be able to convert this with alien to a regular tarball, or use rpm2cpio file | cpio -idmv.

dwarf2json was built directly from the git tree here.

Being a rolling release, we tend to use a pretty current toolchain. If you need more details, let me know.

ilch1 commented 3 years ago

Hi @frispete, could you see if PR #28 (issue-15-elf-relocations branch) works for your DWARF file?

The link to the kernel debug package you posted no longer works. @mkonshie was able to reproduce the error with another kernel debug package, and it appears that PR #28 solves the problem.

ilch1 commented 3 years ago

PR #28 is now merged. Please reopen this issue if that fix doesn't work for your file.