dwarf2json: add FreeBSD kernel support

volatilityfoundation / dwarf2json

convert ELF/DWARF symbol and type information into vol3's intermediate JSON

Other

104 stars 28 forks source link

dwarf2json: add FreeBSD kernel support #64

Open ant1 opened 4 months ago

ant1 commented 4 months ago

FreeBSD kernel ISF can be generated the same way as Linux FreeBSD kernel has a "version" string in the ".data" section

This is how I generate a FreeBSD ISF: dwarf2json linux --elf /usr/lib/debug/boot/kernel/kernel.debug --elf-symbols /boot/kernel/kernel > FreeBSD-14.0-RELEASE-p5-GENERIC-amd64.json

securechicken commented 2 months ago

Tested it on several FreeBSD 14.0 and 14.1 kernels, works well. Will offer minor integration addition (freebsd subcommand) as PR to author's fork.