edb
edb copied to clipboard
Global variable inspection
This issue is similar to #13, yet still requires some different steps. Global variables are DW_TAG_variable
tags typically directly underneath the DW_TAG_compile_unit
. Clang will output tags for these but the DW_AT_location
attributes all point to address 0x00 because it doesn't know about the "global variables in array maps" trick eBPF/Clang employs. So we should should use the BTF to discover in which maps ".rodata/.bss/.data" each variable lives, at which offset and the memory address of the map values. With all of that we should be able to get the raw bytes at runtime and decode them using the BTF to a C literal declaration format.