4

I have an ELF64 binary that comes with *.sym and .debug. From my understanding this is something akin to PDB. While IDA loads it automatically, it fails to process it. I was wondering if Ghidra will fare better but I can't seems to find a way to do so. This issue does say it should be in but I cant figure it out:

Skipping DWARF import because a precondition was not met:
TheMainBinary has more DIE records (2018267) than limit of 2000000
Manually re-run the DWARF analyzer after adjusting the options or start it via Dwarf_ExtractorScript
Improve this question

1 Answer 1

Reset to default
5

Ghidra can in fact parse the .debug section and DWARF information in general, but the error message you posted indicates that it is refusing to do so, because of the too large number of records. It also gives you the two options to explicitly run the analysis nonetheless:

  1. Running the Auto Analysis Step with custom configuration
  2. Running a separate script.

The first option specifically means: In the CodeBrowser view of the specific binary, click Analysis in the top bar, then Auto Analyze '$binaryname'. In the resulting list of analyzers scroll down to DWARF which should then look like this screenshot

enter image description here

change the 2000000 highlighted to anything higher than 2018267, hit analyze, and Ghidra should now rerun the auto analysis but properly import the DWARF information and not skip it like before.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.