tree 58d8dfe1067e86b2ede52b022f23e80d138ffc05
parent 5d978cc81daf3bea01cc0009901b2419f5ef28d6
author Svilen Kanev <skanev@google.com> 1635962748 -0700
committer GitHub <noreply@github.com> 1635962748 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJhgs98CRBK7hj4Ov3rIwAAxTEIABIQhIO6NdVV1r/clCAp6juZ
 3A5vRANd7e9UNDdJ7zGFH6gijRno9uNsFhyD57xdJhtmJiX0as9Wwr9VfeGXTGa8
 fORTB3582YTKUy/G03xg7283rxyRR31I/jyXB3rFZGi8n3mkaA5gqS8a16LOaXIJ
 J2iCuwv1qG66ia/uvi0RMeNoR5ObOuWpU9ISod1UN//r1WYSBUv30GHqzevTj4WT
 sCht7Mt5OppNmsSH2CT2Ut+u3EQv49WgDgWKcMgW+/xl98JJKrSmCqrHeXXfY9eC
 0JsrF47RUGK6nzEHByIGdgpBqrsCZh7Xx6znAjaWhfytJDBIe3fBDhkW5WJTKmI=
 =VMbD
 -----END PGP SIGNATURE-----
 

Extend GetBase heuristics for PIE kernels. (#660)

We are seeing kernels on Aarch64 with ET_DYN Elf headers.
Extend the current ET_EXEC heuristics to handle ET_DYN as well.

Add tests for these exemplars.

Empirical example PIE:
Header: ET_DYN ProgHeader: &{Off: 0x10000 Vaddr: 0xffff000010080000 Align: 0x10000}
103424: ffff000010080000 0 NOTYPE GLOBAL DEFAULT 1 _text
PERF_RECORD_MMAP -1/0: [0xffff000010080000(0xffffeff7ffff) @ 0xffff000010080000]: x [kernel.kallsyms]_text

Empirical example ASLR:
Header: ET_DYN ProgHeader: &{Off: 0x10800 Vaddr: ffffffc010080800 Align: 0x10000}
98865: ffffffc010080800 0 NOTYPE GLOBAL DEFAULT 2 _stext
PERF_RECORD_MMAP -1/0: [0xffffffdb5d680800(0xb7f800) @ 0xffffffdb5d680800]: x [kernel.kallsyms]_stext

Empirical example remapped ChromeOS:
Header: ET_DYN ProgHeader: &{Off: 0x10800 Vaddr: ffffff8008080800 Align: 0x10000}
149888: ffffff8008080800 0 NOTYPE GLOBAL DEFAULT 2 _stext
mapping start: 0x800 lenght: 0xb7f800 offset: 0