get rid of kallsyms_lookup_name

.gitignore

@@ -1,3 +1,5 @@
+src/symbols.h
+
 # Prerequisites
 *.d
 

src/Makefile

@@ -2,6 +2,10 @@ ifndef M
 override M = $(PWD)
 endif
 
+ifndef LINUX_SYSTEM_MAP
+override LINUX_SYSTEM_MAP = /boot/System.map-$(shell uname -r)
+endif
+
 obj-m += afl_snapshot.o
 afl_snapshot-objs := memory.o files.o threads.o task_data.o snapshot.o hook.o module.o
 
@@ -22,6 +26,7 @@ LINUX_DIR ?= /lib/modules/$(shell uname -r)/build
 .PHONY: all
 
 all:
+	sudo env LINUX_SYSTEM_MAP='$(LINUX_SYSTEM_MAP)' python3 lookup_symbols.py
 	$(MAKE) -C '$(LINUX_DIR)' M='$(M)' modules
 
 clean:

src/hook.c

@@ -53,4 +53,3 @@ void unhook_all(void) {
   }
 
 }
-

src/lookup_symbols.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env ptython3
+
+import os
+
+system_map_fname = os.getenv("LINUX_SYSTEM_MAP")
+assert system_map_fname and "Specify the LINUX_SYSTEM_MAP env var with the path to your current kernel system map"
+
+try:
+    fd = open(system_map_fname)
+except:
+    raise RuntimeError(system_map_fname + ' not found, please specify another system map file using the LINUX_SYSTEM_MAP env var')
+
+system_map = map(lambda x: x.split(), fd.read().split('\n'))
+
+register_chrdev_region = None
+sys_call_table = None
+__x64_sys_read = None
+__x64_sys_write = None
+flush_tlb_mm_range = None
+zap_page_range = None
+_etext = None
+
+for e in system_map:
+    if len(e) < 3: continue
+    if e[2] == 'register_chrdev_region':
+        register_chrdev_region = int(e[0], 16)
+    elif e[2] == 'sys_call_table':
+        sys_call_table = int(e[0], 16)
+    elif e[2] == '__x64_sys_read':
+        __x64_sys_read = int(e[0], 16)
+    elif e[2] == '__x64_sys_write':
+        __x64_sys_write = int(e[0], 16)
+    elif e[2] == 'flush_tlb_mm_range':
+        flush_tlb_mm_range = int(e[0], 16)
+    elif e[2] == 'zap_page_range':
+        zap_page_range = int(e[0], 16)
+    elif e[2] == '_etext':
+        _etext = int(e[0], 16)
+
+assert register_chrdev_region != None
+assert sys_call_table != None
+assert __x64_sys_read != None
+assert __x64_sys_write != None
+assert flush_tlb_mm_range != None
+assert zap_page_range != None
+assert _etext != None
+
+with open('symbols.h', 'w') as f:
+    f.write('''#ifndef __AFL_SNAPSHOT_SYMBOLS_H__
+#define __AFL_SNAPSHOT_SYMBOLS_H__
+
+#define SYMADDR(offset) ((unsigned long)register_chrdev_region - \\
+                         0x%x + (offset))
+
+#define SYMADDR_sys_call_table SYMADDR(0x%x)
+#define SYMADDR___x64_sys_read SYMADDR(0x%x)
+#define SYMADDR___x64_sys_write SYMADDR(0x%x)
+#define SYMADDR_flush_tlb_mm_range SYMADDR(0x%x)
+#define SYMADDR_zap_page_range SYMADDR(0x%x)
+#define SYMADDR__etext SYMADDR(0x%x)
+
+#endif
+''' % (register_chrdev_region, sys_call_table, __x64_sys_read, __x64_sys_write, flush_tlb_mm_range, zap_page_range, _etext))

src/module.c

@@ -16,6 +16,7 @@
 #include "hook.h"       // function hooking
 #include "snapshot.h"   // main implementation
 #include "debug.h"
+#include "symbols.h"
 
 #include "afl_snapshot.h"
 
@@ -144,16 +145,16 @@ static void **get_syscall_table(void) {
 
   void **syscall_table = NULL;
 
-  syscall_table = kallsyms_lookup_name("sys_call_table");
+  syscall_table = (void**)SYMADDR_sys_call_table;
 
   if (syscall_table) { return syscall_table; }
 
   int                i;
-  unsigned long long s0 = kallsyms_lookup_name("__x64_sys_read");
-  unsigned long long s1 = kallsyms_lookup_name("__x64_sys_write");
+  unsigned long long s0 = SYMADDR___x64_sys_read;
+  unsigned long long s1 = SYMADDR___x64_sys_read;
 
   unsigned long long *data =
-      (unsigned long long *)((uint64_t)kallsyms_lookup_name("_etext") & ~0x7);
+      (unsigned long long *)(SYMADDR__etext & ~0x7);
   for (i = 0; (unsigned long long)(&data[i]) < ULLONG_MAX; i++) {
 
     unsigned long long d;

src/snapshot.c

@@ -2,6 +2,7 @@
 #include "debug.h"
 #include "task_data.h"
 #include "snapshot.h"
+#include "symbols.h"
 
 void (*k_flush_tlb_mm_range)(struct mm_struct *mm, unsigned long start,
                              unsigned long end, unsigned int stride_shift,
@@ -24,8 +25,8 @@ int exit_hook(struct kprobe *p, struct pt_regs *regs) {
 
 int snapshot_initialize_k_funcs() {
 
-  k_flush_tlb_mm_range = (void *)kallsyms_lookup_name("flush_tlb_mm_range");
-  k_zap_page_range = (void *)kallsyms_lookup_name("zap_page_range");
+  k_flush_tlb_mm_range = (void *)SYMADDR_flush_tlb_mm_range;
+  k_zap_page_range = (void *)SYMADDR_zap_page_range;
 
   if (!k_flush_tlb_mm_range || !k_zap_page_range) { return -ENOENT; }