edb icon indicating copy to clipboard operation
edb copied to clipboard

Global variable inspection

Open dylandreimerink opened this issue 2 years ago • 0 comments

This issue is similar to #13, yet still requires some different steps. Global variables are DW_TAG_variable tags typically directly underneath the DW_TAG_compile_unit. Clang will output tags for these but the DW_AT_location attributes all point to address 0x00 because it doesn't know about the "global variables in array maps" trick eBPF/Clang employs. So we should should use the BTF to discover in which maps ".rodata/.bss/.data" each variable lives, at which offset and the memory address of the map values. With all of that we should be able to get the raw bytes at runtime and decode them using the BTF to a C literal declaration format.

dylandreimerink avatar May 23 '22 18:05 dylandreimerink