asecurity/volatility

Unable to produce a good vtypes file from dwarf on MacOS 10.9.3

Closed this issue · 1 comments

What steps will reproduce the problem?
1. Obtain dwarf from 10.9.3 system and convert it to ("Step 2")
2. Run convert.py on the converted file ("Step 3") to produce the vtypes file

What is the expected output? What do you see instead?

A functioning vtype file w/no errors from convert.py

What version of the product are you using? On what operating system?
2.3.1, Mac OS 10.9.3

Please provide any additional information below.

$ python ../../../../../../tools/mac/convert.py conv10.9.3.64bit.dwarfdump > 
dwarf.txt.conv.vtypes
Traceback (most recent call last):
  File "../../../../../../tools/mac/convert.py", line 660, in <module>
    main()
  File "../../../../../../tools/mac/convert.py", line 657, in main
    parse_dwarf()     
  File "../../../../../../tools/mac/convert.py", line 391, in parse_dwarf
    parser.feed_line(line)
  File "../../../../../../tools/mac/convert.py", line 126, in feed_line
    self.process_statement(**parsed)
  File "../../../../../../tools/mac/convert.py", line 264, in process_statement
    off = int(data['AT_data_member_location'])
KeyError: 'AT_data_member_location'

The source file can be found here: 

https://www.dropbox.com/s/smsio9ep5vwd0wo/conv10.9.3.64bit.dwarfdump


Original issue reported on code.google.com by tor.houg...@gmail.com on 26 Jun 2014 at 10:33

Followed up via email. 

Original comment by michael.hale@gmail.com on 29 Jun 2014 at 5:16

  • Changed state: Done