Development: Improve scripts for operating over Mac KDK

volatilityfoundation · Jun 10, 2020 · 20dbe41 · 20dbe41
1 parent 1a00723
commit 20dbe41
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 7 deletions.
diff --git a/development/mac-kdk/extract_kernel.sh b/development/mac-kdk/extract_kernel.sh
@@ -45,3 +45,6 @@ popd
 rm -fr tmp
 
 ${DWARF2JSON} mac --macho "${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" --macho-symbols "${UNPACK_DIRECTORY}/${KERNEL_DIR}/kernel" | xz -9 > ${JSON_DIR}/${KERNEL_DIR}.json.xz
+if [ $? == 0 ]; then
+  ${DWARF2JSON} mac --arch i386 --macho "${UNPACK_DIR}/${KERNEL_DIR}/kernel.dSYM" --macho-symbols "${UNPACK_DIRECTORY}/${KERNEL_DIR}/kernel" | xz -9 > ${JSON_DIR}/${KERNEL_DIR}.json.xz
+fi
diff --git a/development/mac-kdk/generate_json.sh b/development/mac-kdk/generate_json.sh
@@ -2,19 +2,17 @@
 
 DWARF2JSON=$(which dwarf2json)
 KDK_PATH="${1}"
+JSON_DIR="${2}"
 
 for i in `ls ${KDK_PATH}`;
 do
 	echo "${i}"
-	if [ -f "${KDK_PATH}/${i}/System/DEBUG_Kernel/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" ]; then
-		echo "Mach DEBUG_kernel"
-		${DWARF2JSON} "${KDK_PATH}/${i}/System/DEBUG_Kernel/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" > JSON/${i}.json
+	if [ -f "${KDK_PATH}/${i}/System/Library/Kernels/kernel" ]; then
+		echo "Library Kernels"
+		${DWARF2JSON} mac --macho "${KDK_PATH}/${i}/System/Library/Kernels/kernel.dSYM/Contents/Resources/DWARF/kernel" --macho-symbols "${KDK_PATH}/${i}/System/Library/Kernels/kernel" > ${JSON_DIR}/${i}.json
 	elif [ -f "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" ]; then
 		echo "Mach kernel"
-		${DWARF2JSON} "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" > JSON/${i}.json
-	else
-		echo "Library Kernels"
-		${DWARF2JSON} "${KDK_PATH}/${i}/System/Library/Kernels/kernel.dSYM/Contents/Resources/DWARF/kernel" > JSON/${i}.json
+		${DWARF2JSON} mac --macho "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" --macho-symbols "${KDK_PATH}/${i}/System/mach_kernel" > "${JSON_DIR}/${i}.json" || ${DWARF2JSON} mac --arch i386 --macho "${KDK_PATH}/${i}/System/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel" --macho-symbols "${KDK_PATH}/${i}/System/mach_kernel" > "${JSON_DIR}/${i}.json"
 	fi
 done