Re: Creating new System.map with modules symbol info

[Paulo Marques <pmarques@grupopie.com>]

Adayadil Thomas wrote:
> [...]
> If i Use the original System.map, it doesnt find the symbol for the
> init_conntrack_syn
> ( EIP is pointing there)
> However, kallsyms has an entry for that
> f8b752c8 t init_conntrack_syn
> 
> If kallsyms has all the symbols, I am wondering why does it have lesser lines ?
> 
> wc -l
> 12343 kallsyms
> 32127 System.map

By default kallsyms only stores symbols that are int the kernel's text 
areas, whereas System.map has all the symbols.

You can make kallsyms store all the symbols by setting 
CONFIG_KALLSYMS_ALL in your kernel configuration, but the extra symbol 
data will increase your kernel size. Depending on the target host memory 
size this can be either negligeable or a big problem :)

However, module symbols appear in the /proc/kallsyms file using a 
totally different mechanism, and even if you don't set 
CONFIG_KALLSYMS_ALL, module data symbols (and others) still show up there.

By the way, if you had KALLSYMS configured in the first place, the 
kernel itself would translate those addresses for you for free.

> Will it work if I cat System.map and kallsyms together and do a sort and uniq
> so that i get the union of both ?

Unless you really need non-text symbols, kallsyms should have all the 
information you need. If you need _everything_ then you can just do 
something like (totally untested) "grep \\[ /proc/kallsyms >> 
System.map" to add the symbols from modules to the System.map.

I don't know if the tools out there will like this, though...

-- 
Paulo Marques - www.grupopie.com

The rule is perfect: in all matters of opinion our
adversaries are insane.
Mark Twain