[Vol-dev] Re: Adding kernel version / distro generic Linux support to Volatility (long email & code)

I have been thinking about another issue that will need to be sorted before we begin mass generating profiles..... The problem is that in the current implementation, the file of structure offsets that is used to make the profiles/vtypes is only the offsets that the LKM is coded to gather. This is a problem because every time we need to access a new structure type for some new functionality, the LKM would need to be run again on all the target systems in order to get the offsets that the new code requires. This isn't something we can really deal with and we need a better solution. Unfortunately the only two solutions that come to mind for this are: 1) getting all the offsets at once from a debug kernel build package (vmlinux), but many distro vendors don't package the debug build properly and a number of kernels get skipped 2) writing something that can scan the kernels files (not just the header files, but all files) for a particular kernel tree and all it would need to do is get the name of every structure and all the members. This would also be nice b/c then instead of having to run an LKM to get offsets, you would just have to download a particular kernel's source package (all distros supply these) and run the script to get all the structure names and members list. The rest of the code could then stay how it is and we can support any access to any structure type. The good news is that if 2) were implemented, every other piece of the code can handle addition of structures dynamically, and it would be trivial to automate updating existing profiles to handle the new structures. it would be a simple python script that updated every *_vtype.py file in plugins/overlays/Linux with the new structure information. So does anyone have a better idea than 2) or does anyone know how we can make 2) work well? I know there are a million C file parsers out there already, so we would just need to be able to get one to output structures & members in some reasonable way that we can then format into how gen_vtypes.py expects.