Skip to content

ksymaddr-remote: avoid walking pages #154

@xairy

Description

@xairy

The ksymaddr-remote command invokes Kernel.get_kernel_base(), which calls Kernel.get_maps(), which does pagewalk, which is quite slow in the KGDB mode.

I noticed that the only value ksymaddr-remote actually requires from get_kernel_base() is text_base. Same applies to the kload command and possibly some of the others.

I suspect the text_base value can be figured out without relying on memory maps. E.g., on arm64, VBAR_EL1 points to the vectors symbol, so gef can just calculate the address of _stext based on VBAR_EL1 and kallsyms. I assume for x86, gef could rely on the relative address of the symbol for div0_handler. And there should be something similar for stvec on RISCV.

So it would be great to split out the text_base lookup functionality from get_kernel_base, make it work without relying on pagewalking, and then use it in ksymaddr-remote (and kload and others).

Also, a few related changes that could be done:

  • I think it makes sense to rename get_kernel_base to e.g. get_kernel_bases or get_kernel_layout to point out that it's not just about finding out a single base address.

  • I see that get_kernel_base() relies on sysreg --exact VBAR to get the VBAR_EL1 register value for arm64. This initially failed for me, as my custom GDB extension named the register with its proper name, VBAR_EL1. I see that all the other gef code uses get_register("$VBAR") or get_register("$VBAR_EL1") to get the VBAR value (I assume to support both arm32 and arm64). So using this approach (i.e. also checking for VBAR_EL1) in get_kernel_base() seems like a worthy change to me.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions