anakryiko / retsnoop

Investigate kernel error call stacks
BSD 2-Clause "Simplified" License
186 stars 32 forks source link

Support KALSR in retsnoop #23

Closed anakryiko closed 1 year ago

anakryiko commented 1 year ago

DWARF-based symbolization doesn't work on KASLR kernels.

Checking KASLR kernel:

$ zcat /proc/config.gz | grep RANDOMIZE_BASE
CONFIG_RANDOMIZE_BASE=y

Kernel seems to be able to work around that, see scripts/faddr2line in Linux sources.

Need to study that and see how much harder it is to figure out and normalize base address on KASLR kernels