Re: [Vol-dev] Re: Adding kernel version / distro generic Linux support to Volatility (long email & code)
24 Sep
2010
24 Sep
'10
6:24 p.m.
On Fri, Sep 24, 2010 at 5:17 PM, Michael Cohen <scudette(a)gmail.com> wrote:
This is a little difficult because not only do we need to know the
config options but also how the compiler rounds the offsets for
alignments etc.
Probably a better way is to write a program which:
1) Parses the header files from the kernel headers.
2) Generates the c code for the LKM, compiles and inserts it.
3) Grabs the offsets from the LKM and generates the vtypes
Yes, this will work perfect....
So in order to accomplish this we need code that can parse a kernel
tree (including the .c files) and give us every structure and every
name. As you said, we can then generate the LKM and load it. Also, we
don't have to care about .config options then b/c we will be compiling
against the same headers & .config as the kernel was built.
Basically it boils down to something that can parse a kernel tree and
give us all structures and members. Once that is done, I can trivially
update the existing stuff to support it. Also the profiles don't have
to know about .config options, it can all be handled cleanly in the
code. I can explain this on IRC if you want, but I have already
thought the .config stuff out.