How does symbol address conversion work?

[ultrapikachu]

I'm trying to figure out how to do symbol to address conversion?
From rekall profile json how lib convert to a RIP adress?
What's the process flow / logic ?
(NtOpenFile to 0xblablablablabla)
Do you have a chance to explain briefly?

[ultrapikachu]

windows_kernel_symbol_to_address using rekall_profile_symbol_to_rva.
Values in rekall profile json (these are decimal, i converted to hex) aren't equal RIP adress.
what am i missing?

[tklengyel]

The values in the Rekall profile are relative virtual addresses (aka. rva). Windows randomizes where the kernel gets loaded during boot time. LibVMI finds where the kernel base is and does the symbol resolution by adding the rva to the kernel base.

[ultrapikachu]

Is rva stored decimal type in rekall json file?
And how can we do the opposite? (RIP adress to symbol file)

In addition is the symbol value (coming from converting process) equal to RIP adress?

[Wenzel]

Is rva stored decimal type in rekall json file?

yes: https://raw.githubusercontent.com/Wenzel/vagrant-xen-pyvmidbg/master/fedora/provision/files/win7-profile.json

And how can we do the opposite? (RIP adress to symbol file)

There is an API for that, but only for Linux ATM:
https://github.com/libvmi/libvmi/blob/master/libvmi/libvmi.h#L870

In addition is the symbol value (coming from converting process) equal to RIP adress?

I don't understand your question, can you be more specific ?

[smaresca]

Resolving an instruction pointer to a symbol is more complex. If RIP is related to execution of a very large function (that spans many bytes in memory), resolution to a symbol will rarely be direct. Instead, it's necessary to use debug data to create a range tree (or similar) describing valid address regions for each symbol. Only then is it possible to traverse that tree to identify the related symbol.

Many sources of symbol data (like rekall profiles) do not export the required information, even though PDB and DWARF objects do include such data.