WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Development: Improve scripts for operating over Mac KDK

Browse Source
This commit is contained in:
Mike Auty
2020-06-10 19:49:45 +01:00
parent 1a00723cb0
commit 20dbe41eee
2 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
development/mac-kdk/extract_kernel.sh
+3
View File
@@ -45,3 +45,6 @@ popd
rm -fr tmp
${DWARF2JSON} mac --macho "${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" --macho-symbols "${UNPACK_DIRECTORY}/${KERNEL_DIR}/kernel" | xz -9 > ${JSON_DIR}/${KERNEL_DIR}.json.xz
if [ $? == 0 ]; then
${DWARF2JSON} mac --arch i386 --macho "${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" --macho-symbols "${UNPACK_DIRECTORY}/${KERNEL_DIR}/kernel" | xz -9 > ${JSON_DIR}/${KERNEL_DIR}.json.xz
fi
development/mac-kdk/generate_json.sh
+5 -7
View File
@@ -2,19 +2,17 @@
DWARF2JSON=$(which dwarf2json)
KDK_PATH="${1}"
JSON_DIR="${2}"
for i in `ls ${KDK_PATH}`;
do
echo "${i}"
if [ -f "${KDK_PATH}/${i}/System/DEBUG_Kernel/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" ]; then
echo "Mach DEBUG_kernel"
${DWARF2JSON} "${KDK_PATH}/${i}/System/DEBUG_Kernel/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" > JSON/${i}.json
if [ -f "${KDK_PATH}/${i}/System/Library/Kernels/kernel" ]; then
echo "Library Kernels"
${DWARF2JSON} mac --macho "${KDK_PATH}/${i}/System/Library/Kernels/kernel.dSYM/Contents/Resources/DWARF/kernel" --macho-symbols "${KDK_PATH}/${i}/System/Library/Kernels/kernel" > ${JSON_DIR}/${i}.json
elif [ -f "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" ]; then
echo "Mach kernel"
${DWARF2JSON} "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" > JSON/${i}.json
else
echo "Library Kernels"
${DWARF2JSON} "${KDK_PATH}/${i}/System/Library/Kernels/kernel.dSYM/Contents/Resources/DWARF/kernel" > JSON/${i}.json
${DWARF2JSON} mac --macho "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" --macho-symbols "${KDK_PATH}/${i}/System/mach_kernel" > "${JSON_DIR}/${i}.json" || ${DWARF2JSON} mac --arch i386 --macho "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" --macho-symbols "${KDK_PATH}/${i}/System/mach_kernel" > "${JSON_DIR}/${i}.json"
fi
done