volatilityfoundation / dwarf2json

convert ELF/DWARF symbol and type information into vol3's intermediate JSON
Other
104 stars 28 forks source link

Typedef not found in ISF #67

Open gcmoreira opened 4 weeks ago

gcmoreira commented 4 weeks ago

DWARF2JSON version:

$ ./dwarf2json --version
dwarf2json 0.9.0
output schema 6.2.0

https://elixir.bootlin.com/linux/v6.8/source/include/linux/types.h#L124

typedef s64 ktime_t;

Pahole is able to find the type in the vmlinux dwarf info.

$ pahole ./vmlinux-6.8.0-41-generic -C ktime_t
typedef s64 ktime_t;

However, it is not present in the generated ISF:

$ ./dwarf2json linux --elf ./vmlinux-6.8.0-41-generic | xz -c > Ubuntu_6.8.0-41-generic.json.xz
$ xzcat Ubuntu_6.8.0-41-generic.json.xz | jq ".user_types.ktime_t"
null

$ xzgrep "ktime_t" Ubuntu_6.8.0-41-generic.json.xz
    "ktime_timestamps": {
    "__UNIQUE_ID___addressable_rtc_ktime_to_tm300": {
    "__crc_rtc_ktime_to_tm": {
    "__kstrtab_rtc_ktime_to_tm": {
    "__kstrtabns_rtc_ktime_to_tm": {
    "__ksymtab_rtc_ktime_to_tm": {
    "__pfx_do_timens_ktime_to_host": {
    "__pfx_rtc_ktime_to_tm": {
    "do_timens_ktime_to_host": {
    "rtc_ktime_to_tm": {

It doesn't seem related to the recent Rust bindings issue:

$ pahole ./vmlinux-6.8.0-41-generic --lang=rust -C ktime_t
pahole: type 'ktime_t' not found
Abyss-W4tcher commented 3 weeks ago

If you check other typedef defined in this file, you will find that none of them can be accessed in the ISF (fd_set for example).

It seems that dwarf2json simply skips them :

diff --git a/main.go b/main.go
index 06e3f65..49e2fee 100644
--- a/main.go
+++ b/main.go
@@ -427,6 +427,8 @@ func (doc *vtypeJson) addDwarf(data *dwarf.Data, endian string, extract Extract)
                                if err != nil {
                                        return fmt.Errorf("could not parse struct: %s", err)
                                }
+                       } else {
+                               fmt.Fprintf(os.Stdout, "tyoedef error : %s\n", typedefType.Name)
                        }

                }

You'll find ktime_t and others with go build && ./dwarf2json linux --elf ../vmlinux-6.8.0-41-generic | grep 'ktime_t'.