Skip to content

Instantly share code, notes, and snippets.

@kvnlvn
Created January 23, 2018 03:51
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save kvnlvn/3a2fc08e0f5137c2400b5bee9a40b977 to your computer and use it in GitHub Desktop.
Save kvnlvn/3a2fc08e0f5137c2400b5bee9a40b977 to your computer and use it in GitHub Desktop.
kallsyms loader for IDA
/* kallsyms loader */
/* by goroh_kun */
/* modified from H2enum Version 1.09 */
#include <idc.idc>
// returns -1 if symbol is NOT 'space'
static is_space(c)
{
return strstr(" \t\r\n\b",c);
}
// strip leading blank characters from string.
static ltrim(str)
{
auto pos,c,l;
l = strlen(str);
pos = 0;
while (pos < l)
{
c = substr(str,pos,pos+1);
if (is_space(c) == -1) break;
pos++;
}
return substr(str,pos,-1);
}
// strip trailing blank characters from string.
static rtrim(str)
{
auto pos,c;
pos = strlen(str);
while (pos > 0)
{
c = substr(str,pos-1,pos);
if (is_space(c) == -1) break;
pos--;
}
return substr(str,0,pos);
}
/*static trim(str)
{
return rtrim( ltrim(str) );
}*/
// Find first delimiter position in string (SPACE or TAB).
static FindDelim(str)
{
auto pos1,pos2;
pos1 = strstr(str," ");
pos2 = strstr(str,"\t");
if (pos1 == -1) return pos2;
if (pos2 == -1) return pos1;
if (pos1 < pos2) return pos1;
else return pos2;
}
// Main conversion routine
static load_kallsyms(fname)
{
auto def_addr, def_name, def_type;
auto hFile,in_str,pos,str_no,c;
if ((hFile=fopen(fname,"r")) == 0)
{
Warning("Couldn't open file '%s'!",fname);
return -1;
}
Message("Conversion started...\n");
str_no = 0;
while ((in_str=readstr(hFile)) != -1)
{
str_no++;
pos = FindDelim(in_str);
def_addr = xtol(substr(in_str, 0, pos));
in_str = substr(in_str, pos + 1, -1);
pos = FindDelim(in_str);
def_type = substr(in_str, 0, pos);
in_str = substr(in_str, pos + 1, -1);
def_name = trim(in_str);
MakeCode(def_addr);
if(0 == MakeNameEx(def_addr, def_name, SN_NOCHECK | SN_NOWARN | SN_AUTO)){
auto i;
for(i=1; i<100; i++){
def_name = def_name + "_" + ltoa(i, 10);
if(0 != MakeNameEx(def_addr, def_name, SN_NOCHECK | SN_NOWARN | SN_AUTO)){
break;
}
}
}
Message("name %s = '%08x'(%s)\n", def_name, def_addr, def_type);
}
fclose(hFile);
Message("Successful %d elements imported.\n", str_no);
return 0;
}
static main()
{
auto fname;
fname = AskFile(0,"*.txt","Choose a kallsyms file to parse:");
if (fname == "") return;
load_kallsyms(fname);
}
@DavidBuchanan314
Copy link

Ok so dumb question:

It appears to work, and I get output like this:


_1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88_89_90_91_92_93_94_95_96_97_98_99 = 'ffffffff81b29000'(B)
name __bss_stop
_1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88_89_90_91_92_93_94_95_96_97_98_99 = 'ffffffff81b29000'(B)
name .brk.early_pgt_alloc
_1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88_89_90_91_92_93_94_95_96_97_98_99 = 'ffffffff81b39000'(b)
name __brk_limit
_1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88_89_90_91_92_93_94_95_96_97_98_99 = 'ffffffff81b3f000'(B)
name _end
_1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50_51_52_53_54_55_56_57_58_59_60_61_62_63_64_65_66_67_68_69_70_71_72_73_74_75_76_77_78_79_80_81_82_83_84_85_86_87_88_89_90_91_92_93_94_95_96_97_98_99 = 'ffffffff81b3f000'(B)
Successful 30345 elements imported.

But nothing changes in the functions list, and I don't see any of the symbols actually being used anywhere. What am I missing?

What's the purpose of the for(i=1; i<100; i++){ loop?

ping @sora42

@personshelldon
Copy link

@DavidBuchanan314, did You find the solution? The same problem here...

@DavidBuchanan314
Copy link

I don't think I did. But looking at it now, I think the problem was that there was a newline on the end of the symbol name. I guess trim() doesn't work properly (it's commented out?)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment