dwarf2json
open-sourceThe section your link pointed to isn't on dwarf2json's page any more, so we've brought you to the top.
dwarf2json is a Go utility that processes files containing symbol and type information to generate Volatility3 Intermediate Symbol File (ISF) JSON output.
Summary
dwarf2json is an open-source command-line utility that converts DWARF debug information and symbol tables from ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. and Mach-O binaries into Volatility3 Intermediate Symbol File (ISF) JSON, and it costs nothing to use. You build it from source with Go and run it as dwarf2json linux or dwarf2json mac against a kernel or binary file, producing the JSON symbol file Volatility3 needs to analyze a memory image. It is aimed at DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. practitioners doing memory forensics on Linux and macOS systems, particularly those who maintain their own symbol tables for hosts not covered by public repositories. Its README describes it as a companion utility to Volatility3 rather than a competing product, filling the symbol-generation step that framework depends on. Development goes back to 2017 with 7 contributors and four tracked releases, though there have been no commits in the past year and the last release was 681 days ago, worth weighing if you need active maintenance.
dwarf2json is a Go utility that processes files containing symbol and type information to generate Volatility3 Intermediate Symbol File (ISF) JSON output.
How dwarf2json helps
Can I get Volatility3 to recognize the exact kernel build my memory image came from?
it reads the DWARF and symbol table data out of that specific kernel's debug binary and emits an ISF JSON symbol file keyed to that build, so Volatility3 can map raw offsets in the image back to structures and functions
Which symbol source should win when my debug binary and my System.map disagree on an address?
it merges both inputs into one ISF file using a fixed precedence, with System.map values overriding ELF symbol-table values, which in turn override symbols parsed from DWARF
Do I have both the type layout and the symbol names I need, or just one?
separate options let you pull symbols only, types only, or both from a given file, so you can combine a stripped binary's symbols with a separate file's type information in one output
Can I build one symbol file that covers several related binaries at once?
it accepts multiple input files under the same flag and folds them into a single ISF document, resolving conflicts between them by the same precedence rule used for mixed symbol sources
Will this work on the macOS kernel binary I pulled from a Mach-O image, not just Linux?
it has a separate mode for Mach-O input that extracts the same kind of symbol and type data and emits ISF JSON in the same schema, including for FAT binaries with multiple architectures
Is the ISF file I generated actually usable, or did something go wrong silently?
it exits with a status code and writes a JSON document stamped with a format version and producer version, containing base types, symbol table, and metadata, so a zero exit with populated tables confirms the extraction succeeded
Languages
Command line
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Release-note detail over time
See how much detail dwarf2json puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
Nothing shipped since we started watching. Releases and docs updates land here as they happen.
Project health
Issue, contributor and maintainer activity in volatilityfoundation/dwarf2json, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 0 −1 vs prior 12 months
- Maintainers 0 +0 joined · −0 left, last 12 months
- Bus factor 0 committers behind half the commits
- Community-filed not measured of issues opened, last 12 months
- Median time to close not measured issues closed, last 12 months
- Open backlog 11 of 42 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 11
- Contributors / month 0
- Commits / month 0
- Stars 160
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →