volatilityfoundation / dwarf2json

convert ELF/DWARF symbol and type information into vol3's intermediate JSON
Other
106 stars 28 forks source link

prevent ELF relocations from being applied prior to DWARF parsing #28

Closed ilch1 closed 3 years ago

ilch1 commented 3 years ago

Prior to this commit, Go's built-in elf.File.DWARF() function was used to extract DWARF data from an ELF file. This code applies ELF relocations prior to parsing.

Several Linux kernels were encountered that causes panics due to stack depth. The root cause was determined to be invalid DWARF offsets due to ELF relocations.

This commit forks the DWARF() function into its own file and removes the relocation processing. The code is otherwise unchanged.

main.go has been updated to call the local function instead of the library.

Addresses issue #15.