Add API endpoints and CLI support for discovering C++ classes and symbolication of kernelcaches, refactor Mach-O handling, and improve symbol collection.
- API: add /kernel/cpp and /kernel/symbolicate routes, request param structs, response types, and openKernel helper. Use cpp scanner and signature parsing to return classes and symbol maps.
- CLI: wire scanner LogStats flag, refactor kernel symbolicate command (schema writer helper, improved signature parsing, and symbol matching logic). Add tests for symbolicator schema and kernel symbol matching.
- Signature pkg: add kernel C++ symbol extraction (pkg/signature/kernel_cpp.go) and SymbolicateMachO to symbolicate already-open Mach-Os; integrate C++ symbols into symbol map and update signature matching/logging behavior.
- Internal: refactor in-memory DB lookups (findMachOByUUID, findSymbolByAddr) to reduce duplication. Improve symbols collection for kernel Mach-Os (collectKernelMachoSymbols, extra kernel symbols from signature/C++), add helpers to append symbols.
- Kernelcache CPP: add LogStats option and conditional logging of scan stats.
- Crashlog/ips: update wording to reflect kernel symbols are from kernel analysis and store KernelSymbols earlier in processing; parse signatures only when configured.
Also add unit tests for new symbolication helpers and kernel C++ signature handling. Overall this consolidates kernel symbol discovery, improves reuse, and surfaces C++-derived symbols in symbol maps.
- Add KernelSymbols to Ips and populate during symbolication so the generated IDA script can apply names discovered via
--signatures.
- Make IDA script generation safer: escape Python string literals and sort kernel symbol addresses for deterministic
output.
- Extract symbol names referenced by branch targets from peek bytes and attach them to PanicFrame.PeekSymbols for
display in disassembly. Results are optionally demangled.
- Thread PeekSymbols into formatPeekDisassembly to show branch target names, and add defensive operand checks in
disassembler triage.
- Introduced --peek flag to show disassembly instructions around each panicked frame.
- Added --peek-count flag to specify the number of instructions to display (default is 5).
- Implemented logic to read and format peek bytes for both user and kernel frames.
- Updated command examples in documentation to reflect new functionality.
- Enhanced error handling for custom KASLR and DSC slides.
blacktop
codecoloristandGitHub