WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Documentation: Add summary table for linux/mac ISF creation

Browse Source
This commit is contained in:
Mike Auty
2022-01-15 22:02:02 +00:00
parent 8791631db5
commit a9e5589260
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/source/symbol-tables.rst
+18
View File
@@ -76,3 +76,21 @@ The banners available for volatility to use can be found using the `isfinfo` plu
long time to run depending on the number of JSON files available. This will list all the JSON (ISF) files that
volatility3 is aware of, and for linux/mac systems what banner string they search for. For volatility to use the JSON
file, the banners must match exactly (down to the compilation date).
.. note::
Steps for constructing a new kernel ISF JSON file:
* Run the `banners` plugin on the image to determine the necessary kernel
* Locate a copy of the debug kernel that matches the identified banner
* Clone or update the dwarf2json repo: :code:`git clone https://github.com/volatilityfoundation/dwarf2json`
* Run :code:`go build` in the directory if the source has changed
* Run :code:`dwarf2json linux --elf [path to debug kernel] > [kernel name].json`
* For Mac change `linux` to `mac`
* Copy the `.json` file to the symbols directory into `[symbols directory]/linux`
* For Mac change `linux` to `mac`