DWARF¶
DWARF is a format for debugging info relating to ELF files. Standard compilations of binaries do not contain DWARF info. However, when you compile binaries with this info (generally with the -g flag), much more useful inforamtion is available. This plugin attempts to expose that information.
General Interaction¶
General interaction with the DWARF plugin is via the modules. For instance:
bin = process.modules['bin']
dwarf = bin.dwarf
Functions¶
Functions are enumerated and exposed via the
functions
property. You can utilize the
lookup_function()
method to resolve an
address to it’s function.
Source Lookup¶
The DWARF plugin can assist with looking up what the corresponding file and
line number would be for a given address. As with all things in revenge
this address is the current loaded address, rather than a base address. This
lookup can be done via lookup_file_line()
.
You can also ask DWARF to “decompile” an address for you. Note, this isn’t
actually decompiling, but the names are kept the same to avoid confusion.
Instead of actually decompiling, the plugin will attempt to lookup the source
address and line for your running address, and then lookup the corresponding
source code for it. You must ensure you have told the plugin where your source
directories are by using add_source_path()
.
Lookups for a source address can be done via
decompile_address()
and
decompile_function()
.