mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-26 03:24:50 +02:00
Development: Improve extract_kernel for the Mac KDK
This commit is contained in:
@@ -1,12 +1,21 @@
|
||||
#!/bin/bash
|
||||
|
||||
echo "Operating on ${1}"
|
||||
UNPACK_DIR="Unpacked"
|
||||
KERNEL_DIR="$(basename ${1})"
|
||||
JSON_DIR="JSON"
|
||||
DWARF2JSON="dwarf2json"
|
||||
|
||||
echo "Operating on ${KERNEL_DIR}"
|
||||
mkdir tmp
|
||||
pushd tmp
|
||||
|
||||
|
||||
7z x ../${1}
|
||||
if [ -f "KernelDebugKit/mach_kernel" ]; then
|
||||
echo "7Z unpack successful"
|
||||
mv KernelDebugKit System
|
||||
else
|
||||
echo "XAR unpack required"
|
||||
xar -x -f Kernel\ Debug\ Kit/KernelDebugKit.pkg
|
||||
python2 ../parse_pbzx2.py KDK.pkg/Payload
|
||||
if [ $? == 0 ]; then
|
||||
@@ -15,12 +24,24 @@ else
|
||||
else
|
||||
7z x Kernel\ Debug\ Kit/KernelDebugKit.pkg
|
||||
fi
|
||||
echo "CPIO unpacking Payload"
|
||||
cpio -i < Payload\~
|
||||
fi
|
||||
mkdir -p "../Unpacked/${1}"
|
||||
cp -r System "../Unpacked/${1}"
|
||||
chmod -R ug+w "../Unpacked/${1}"
|
||||
# /home/mike/tmp/dwarf2json/go/bin/dwarf2json "System/Library/Kernels/kernel.dSYM/Contents/Resources/DWARF/kernel" > "../JSON/${1}.json"
|
||||
|
||||
mkdir -p "../${UNPACK_DIR}/${KERNEL_DIR}"
|
||||
|
||||
if [ -f "System/Library/Kernels/kernel" ]; then
|
||||
cp "System/Library/Kernels/kernel" "../${UNPACK_DIR}/${KERNEL_DIR}/kernel"
|
||||
cp "System/Library/Kernels/kernel.dSYM/Contents/Resources/DWARF/kernel" "../${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM"
|
||||
elif [ -f "System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" ]; then
|
||||
cp System/mach_kernel "../${UNPACK_DIR}/${KERNEL_DIR}/kernel"
|
||||
cp System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel "../${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM"
|
||||
fi
|
||||
|
||||
chmod -R ug+w "../${UNPACK_DIR}/${KERNEL_DIR}"
|
||||
|
||||
${DWARF2JSON}
|
||||
popd
|
||||
rm -fr tmp
|
||||
mv "${1}" Complete
|
||||
|
||||
${DWARF2JSON} mac --macho "${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" --macho-symbols "${UNPACK_DIRECTORY}/${KERNEL_DIR}/kernel" | xz -9 > ${JSON_DIR}/${KERNEL_DIR}.json.xz
|
||||
|
||||
Reference in New Issue
Block a user