search

marin-m / vmlinux-to-elf

A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)
GNU General Public License v3.0
1.37k stars 131 forks source link

Added progress bar #45

Closed BillBrousalis closed 1 year ago

BillBrousalis commented 1 year ago

Although this runs fast on most kernel images, I came across a few that took almost 25 minutes to complete, and had me wondering whether the script was stuck somewhere. I added a progress bar when iterating through "kallsyms_finder.symbols", which sometimes takes a while.

Myldero commented 1 year ago

Really wonder why it would take 25 minutes to complete... Are you able to share the kernel image?

BillBrousalis commented 1 year ago

It comes from a ctf challenge I was attempting, from hxp ctf 2020, called kernel-rop. You can find the challenge containing the image here: https://ctftime.org/task/14383 I attempted to use the tool on this with 2 (quite capable) machines, and was left thinking the tool was hanging on me both times. To be honest any other image I've tried is quite fast, 10 seconds to a minute, but the progress bar is nice nontheless.

Myldero commented 1 year ago

Thanks. I immediately see why this is slow. An O(n*m) algorithm is used for calculating which section a symbol is placed in. For some reason, this kernel image has 36140 sections where normally it's around 100. This of course makes it very slow. I'll try optimizing it a little bit, so that loop doesn't take more than 10-15 seconds :)

marin-m commented 1 year ago

Hello,

Thanks for your proposal and reporting the issue. I'm closing though as pull request #47 addressed the issue another way.

Regards,