On Wed, Oct 16, 2013 at 9:02 AM, Andrew Honig <aho...@google.com> wrote: > I'm talking about working with a vmlinux/vmcore pair. To get crash > working with the current version of kASLR that doesn't have the offset > data specifically in the VMCOREINFO I could use another symbol in the > VMCOREINFO to calculate the offset. For example _stext is already in > the VMCOREINFO. I could get the offset of _stext from the VMCOREINFO, > then get the offset of _stext from the vmlinux and subtract them to > get the ASLR offset.
Doing this math seems like a good approach. Are there any downsides to inferring the kASLR offset this way? -Kees -- Kees Cook Chrome OS Security -- Crash-utility mailing list Crash-utility@redhat.com https://www.redhat.com/mailman/listinfo/crash-utility
