Symbol table offsets incorrect?
pnill opened this issue · comments
Trying to load the attached image (after) KALSR fix the symbol table seems off, some of the symbols written even seem to overwrite others at the same offset wondering if anyone who's following this has an idea on what might be going wrong.
Example of offsets being overwritten by the same symbols:
ffffff8008080000 T _text
ffffff8008080000 T do_undefinstr
ffffff8008080000 T _stext
ffffff8008080800 T __exception_text_start
ffffff8008080800 T do_cp15instr
ffffff8008080800 T do_sysinstr
ffffff80080810a0 T __irqentry_text_end
ffffff80080810a0 T __irqentry_text_start
ffffff80080810a0 T __softirqentry_text_start
ffffff80080810a0 T __entry_text_start
ffffff80080810a0 T __softirqentry_text_end
ffffff8008082970 t el1_sp_pc
ffffff8008082970 t el1_undef
When looking at various functions against the actual kernel source in a decompiler it was pretty clear that the symbol table being generated by the vmlinux.py script was off/wrong, I've been reading through the source to see how all of this works and try to correct it but figured in the mean time path of least resistance may be asking those who are already familiar with what it's doing.
Any help would be greatly appreciated...
If we take linux_banner as the anchor, it seems the overall offset is good. It seems some entries have bad offset value filled in by fix_kaslr_arm64. If you built the kernel yourself, would you share the original vmlinux before stripping (a valid elf with symbols)?
I actually did not build it myself and have not been successful in building it so far either this is the kernel:
https://github.com/facebookincubator/oculus-linux-kernel/tree/oculus-quest2-kernel-master
That's how I've been comparing the symbol table to what a function should look like, as well as looking at similar functions within another image to see if they're different and things do indeed seem off.