dwarf2json is a command-line utility that generates Intermediate Symbol File (ISF) JSON for Volatility. These files provide the symbol addresses and type definitions needed to interpret operating-system structures in memory captures.
The tool processes kernel binaries, debugging information and symbol maps supplied by the analyst. It prepares supporting files rather than acquiring memory or examining dumps itself. Processing large DWARF files requires at least 8 GB of RAM.
This is free and open source software.
Key Features
- Extract DWARF debugging information and symbol-table entries from ELF files for Linux memory analysis.
- Read Linux System.map files to supplement or override symbol addresses obtained from other inputs.
- Process Mach-O binaries and associated debugging information for macOS memory analysis.
- Choose whether each input contributes symbols, type definitions or both, allowing separate sources for different information.
- Combine multiple input files in a single operation, including kernel debugging files and separate symbol tables.
- Apply defined precedence to conflicting Linux symbol offsets: System.map entries override ELF symbol-table entries, which override DWARF-derived addresses.
- Prefer Mach-O symbol-table offsets over addresses extracted from DWARF information.
- Use information from the last specified file when inputs of the same category contain conflicting definitions.
- Select the required embedded architecture when reading universal Mach-O binaries.
- Skip Rust compilation units to prevent collisions with C symbols, types and enumerations.
- Write JSON to standard output for saving to a file or incorporating into automated workflows.
- Cross-platform support – runs on Linux, macOS, and Windows.
Website: github.com/volatilityfoundation/dwarf2json
Support:
Developer: Volatility Foundation and contributors
License: Volatility Software License
dwarf2json is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Forensics Memory Tools | |
|---|---|
| MemProcFS | View physical memory as files in a virtual file system |
| pypykatz | Python implementation of Mimikatz |
| PCILeech | Security research and memory acquisition tool |
| Volatility | Advanced memory forensics framework |
| AVML | Acquire Volatile Memory for Linux |
| Volshell | CLI tool for working with memory |
| LeechCore | Physical memory acquisition library |
| EVTXtract | Recovers and reconstructs fragments of EVTX log files |
| mquire | Memory forensics and analysis tool |
| LEMON | Memory acquisition utility |
| yarp | Yet Another Registry Parser |
| emd | Command line memory acquisition tool for Linux systems |
| AutoTimeliner | Extract forensic timeline from volatile memory dump |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.