{"id":30280585,"url":"https://github.com/vmi-rs/isr","last_synced_at":"2025-08-16T15:25:37.519Z","repository":{"id":261347201,"uuid":"883988420","full_name":"vmi-rs/isr","owner":"vmi-rs","description":"Intermediate Symbol Representation","archived":false,"fork":false,"pushed_at":"2025-03-31T22:06:46.000Z","size":132,"stargazers_count":10,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-08-10T19:24:15.606Z","etag":null,"topics":["dwarf","isr","pdb"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vmi-rs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-11-05T23:48:33.000Z","updated_at":"2025-04-07T12:48:36.000Z","dependencies_parsed_at":null,"dependency_job_id":"d0ec5200-b1c3-45e1-bd71-889394aa0a23","html_url":"https://github.com/vmi-rs/isr","commit_stats":null,"previous_names":["vmi-rs/isr"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/vmi-rs/isr","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmi-rs%2Fisr","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmi-rs%2Fisr/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmi-rs%2Fisr/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmi-rs%2Fisr/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vmi-rs","download_url":"https://codeload.github.com/vmi-rs/isr/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vmi-rs%2Fisr/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270730188,"owners_count":24635581,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-16T02:00:11.002Z","response_time":91,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dwarf","isr","pdb"],"created_at":"2025-08-16T15:25:32.654Z","updated_at":"2025-08-16T15:25:37.510Z","avatar_url":"https://github.com/vmi-rs.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Crates.io](https://img.shields.io/crates/v/isr.svg)](https://crates.io/crates/isr)\n[![Downloads](https://img.shields.io/crates/d/isr.svg)](https://crates.io/crates/isr)\n[![Docs](https://docs.rs/isr/badge.svg)](https://docs.rs/isr/latest/isr/)\n[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/vmi-rs/isr/blob/master/LICENSE)\n\n# Intermediate Symbol Representation\n\nThe `isr` crate provides a unified, version-agnostic way to access and\nutilize debugging symbols from various sources, including PDB files\n(Windows) and DWARF debug info (Linux). This allows developers to write\ncode that interacts with different operating system versions without\nneeding to hardcode offsets or constantly update for new releases.\n\n## Features\n\n- **Unified Representation:** Abstracts away the underlying symbol format\n  (PDB, DWARF) into a common, easy-to-use structure.\n\n- **Version Agnostic:** Enables writing code that works seamlessly across\n  different OS versions, avoiding the need for version-specific logic.\n\n- **Fast Symbol Parsing:** The ISR parsing process is highly optimized for\n  speed, enabling quick access to symbol information.\n\n- **Automated Symbol Download and Caching:** For Windows, automatically\n  downloads and caches PDB symbols based on CodeView information extracted\n  from executables or the kernel itself.\n\n  For Linux (currently Ubuntu), automatically downloads and extracts the\n  kernel debug symbols and the `System.map` file.\n\n- **Convenient Macros:** Provides [`symbols!`] and [`offsets!`] macros for\n  streamlined symbol definition and type-safe access in your code.\n\n- **Codec Support:** Supports multiple serialization formats (Bincode, JSON,\n  MessagePack) for storing and loading profiles, letting users choose\n  between speed and human-readability.\n\n## Usage\n\n```rust,ignore\nuse isr::{\n    cache::JsonCodec,\n    download::pdb::CodeView,\n    macros::{symbols, offsets, Field},\n    IsrCache, Profile,\n};\n\nsymbols! {\n    struct Symbols {\n        NtCreateFile: u64,\n    }\n}\n\noffsets! {\n    struct Offsets {\n        struct _EPROCESS {\n            UniqueProcessId: Field,\n        }\n    }\n}\n\n// Create a cache instance.\nlet cache = IsrCache::\u003cJsonCodec\u003e::new(\"cache\")?;\n\n// Use the CodeView information of the Windows 10.0.18362.356 kernel.\nlet entry = cache.entry_from_codeview(CodeView {\n    path: String::from(\"ntkrnlmp.pdb\"),\n    guid: String::from(\"ce7ffb00c20b87500211456b3e905c471\"),\n})?;\n\n// You can also use `entry_from_pe` method:\n// let entry = cache.entry_from_pe(\"path/to/ntoskrnl.exe\")?;\n\nlet profile = entry.profile()?;\n\n// Instantiate your symbol and offset structures using the profile.\nlet symbols = Symbols::new(\u0026profile)?;\nlet offsets = Offsets::new(\u0026profile)?;\n```\n\n### Downloading Ubuntu Kernel Profiles\n\nDownloading the required files for creating an Ubuntu kernel profile can\ntake a considerable amount of time due to the large size of the debug symbol\npackages. The download may exceed 1GB of data.\n\n## Additional Notes\n\nPeople familiar with the Volatility 3 or Rekall framework might notice that\nthe ISR format shares some conceptual similarities with their profiles (or\nIntermediate Symbol Format (ISF), respectively). All of them aim to provide\na unified representation of kernel symbols and structures. However, it's\ncrucial to note that the ISR format is **not** compatible with other\nframeworks. ISR is specifically designed for the [`vmi`] crate.\n\n# License\n\nThis project is licensed under the MIT license.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvmi-rs%2Fisr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvmi-rs%2Fisr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvmi-rs%2Fisr/lists"}