Sarif exporter: how to get symbol type information

[gynt]

EDIT: I found the solution.

Initially I was confused about the sarif export. Using the sarif export functionality, how do I get information on the global symbols and their type?

For example, exporting symbols yields me the result below, but the type information is missing.

Solution: Use the Symbol entries in the sarif export to get the absoluteAddress. Then search through the sarif export for that absolute address to get the DefinedData entry for that address. From that entry you can get the data type. I guess it is like this because a single address can have multiple symbols (labels).

       {
        "message": {
          "text": "Symbol"
        },
        "kind": "informational",
        "level": "none",
        "ruleId": "SYMBOLS",
        "locations": [
          {
            "physicalLocation": {
              "address": {
                "absoluteAddress": 5884896,
                "length": 1
              }
            }
          }
        ],
        "properties": {
          "additionalProperties": {
            "name": "D",
            "location": "A::B::C",
            "kind": "local",
            "sourceType": "USER_DEFINED",
            "primary": true,
            "pinned": false
          }
        }
      },

[ReversingWithMe]

Symbols I think don't have types, the defined data would, so you would want to reference this symbol to the defined data at address 5884896 in your example.

Example from my own SARIF output, and where the type lives for my global var.

[d-millar]

@gynt @ReversingWithMe Apologies for not responding sooner - am traveling and wanted to verify what i thought was the correct answer. You beat me to it! Symbols have something called “type”, but this refers to a more generic group, i.e. Function, Class, Namespace, etc. DefinedData is really what you want. Thanks for following up and helping me out!