Function resolve_kernel

src/os/linux/kernel_resolver.cpp:118–334

}

KernelContext resolve_kernel(const PhysicalLayer& phys, const IsfSymbols& isf) {
    KernelContext ctx{};

    // init_task is OPTIONAL: full DWARF-derived ISFs have it (so we can
    // derive KASLR shift symbolically); BTF-derived ISFs only carry types,
    // so we fall back to direct-from-swapper-scan init_task discovery and a
    // best-effort KASLR shift (=0 unless banner symbol is also present).
    auto init_task_sym = isf.find_symbol("init_task");
    const bool have_symbols = (init_task_sym != nullptr);
    if (!have_symbols) {
        log::warn("ISF has no `init_task` symbol — running in BTF/types-only "
                  "mode. Process listing will work via direct-map; kernel-VA "
                  "reads (kallsyms, modules, dmesg, DTB walks) will be limited.");
    }

    warn_if_isf_mismatch(phys, isf);

    u64 task_struct_size = isf.type_size("task_struct");
    u64 comm_off         = isf.field_offset("task_struct", "comm");
    u64 pid_off          = isf.field_offset("task_struct", "pid");
    u64 tgid_off         = isf.field_offset("task_struct", "tgid");
    u64 tasks_off        = isf.field_offset("task_struct", "tasks");

    if (have_symbols)
        log::debug("init_task VA (pre-KASLR) = {:#x}", init_task_sym->address);
    log::debug("task_struct: size={:#x} pid@{:#x} comm@{:#x} tasks@{:#x}",
              task_struct_size, pid_off, comm_off, tasks_off);

    // First try a banner-based shift (robust against task_struct layout drift).
    auto banner_candidates = banner_candidate_shifts(phys, isf);
    log::debug("Banner string found at {} location(s)", banner_candidates.size());
    for (auto& [at, sh] : banner_candidates) {
        bool aligned_2mb = (sh & 0x1FFFFF) == 0;
        log::debug("  banner @ PA {:#x} shift={:#x} 2MB-aligned={}", at, sh, aligned_2mb);
    }

    auto hits = scan_swapper(phys);
    if (hits.empty()) throw_error("kernel: no swapper signature found");

    const VAddr init_task_sym_addr = have_symbols ? init_task_sym->address : 0;

    for (PAddr comm_pa : hits) {
        PAddr task_pa = (comm_pa >= comm_off) ? (comm_pa - comm_off) : 0;

        u32 pid = 0;
        bool ok_pid   = phys.read_pod(task_pa + pid_off, pid);
        u64 next = 0, prev = 0;
        bool ok_next  = phys.read_pod(task_pa + tasks_off + 0, next);
        bool ok_prev  = phys.read_pod(task_pa + tasks_off + 8, prev);

        // dump the comm bytes for sanity
        char buf[24] = {};
        phys.read(comm_pa, buf, 16);
        log::debug("comm bytes @ {:#x}: '{}' (raw: {:02x} {:02x} {:02x} {:02x} {:02x} {:02x} {:02x} {:02x} {:02x})",
                   comm_pa, buf, (u8)buf[0],(u8)buf[1],(u8)buf[2],(u8)buf[3],(u8)buf[4],
                   (u8)buf[5],(u8)buf[6],(u8)buf[7],(u8)buf[8]);
        log::debug("candidate: comm_pa={:#x} task_pa={:#x} pid={} (ok={}) next={:#x} prev={:#x} (ok={},{})",
                   comm_pa, task_pa, pid, ok_pid, next, prev, ok_next, ok_prev);