search

nforest / droidimg

Android/Linux vmlinux loader
336 stars 91 forks source link

Symbol table offsets incorrect? #50

Open pnill opened 4 years ago

pnill commented 4 years ago

Trying to load the attached image (after) KALSR fix the symbol table seems off, some of the symbols written even seem to overwrite others at the same offset wondering if anyone who's following this has an idea on what might be going wrong.

Example of offsets being overwritten by the same symbols:

ffffff8008080000 T _text ffffff8008080000 T do_undefinstr ffffff8008080000 T _stext ffffff8008080800 T __exception_text_start ffffff8008080800 T do_cp15instr ffffff8008080800 T do_sysinstr

ffffff80080810a0 T irqentry_text_end ffffff80080810a0 T irqentry_text_start ffffff80080810a0 T softirqentry_text_start ffffff80080810a0 T entry_text_start ffffff80080810a0 T __softirqentry_text_end

ffffff8008082970 t el1_sp_pc ffffff8008082970 t el1_undef

When looking at various functions against the actual kernel source in a decompiler it was pretty clear that the symbol table being generated by the vmlinux.py script was off/wrong, I've been reading through the source to see how all of this works and try to correct it but figured in the mean time path of least resistance may be asking those who are already familiar with what it's doing.

Any help would be greatly appreciated...

extracted.zip

idl3r commented 4 years ago

If we take linux_banner as the anchor, it seems the overall offset is good. It seems some entries have bad offset value filled in by fix_kaslr_arm64. If you built the kernel yourself, would you share the original vmlinux before stripping (a valid elf with symbols)?

pnill commented 4 years ago

I actually did not build it myself and have not been successful in building it so far either this is the kernel:

https://github.com/facebookincubator/oculus-linux-kernel/tree/oculus-quest2-kernel-master

That's how I've been comparing the symbol table to what a function should look like, as well as looking at similar functions within another image to see if they're different and things do indeed seem off.