Kernel on dere3046

ksymless on older kernels

Thu, 02 Jul 2026 14:00:00 +0800

v3 discovered kallsyms data by scanning for token_index (256 x u16, ti[0]=0), then reading kallsyms_offsets 512 bytes after it. works on GKI 6.6 and 6.12. fails on 5.10, 5.15, and 6.1.

the reason is simple. the binary output order of write_src() in scripts/kallsyms.c changed between kernel versions.

the layout shift happened somewhere between 6.1 and 6.6. android14-6.1 still uses the old order, android15-6.6 uses the new one.

in the old layout (i call it v1), offsets come first. the entire block looks like: offsets, then kallsyms_relative_base (8 bytes, value is _text), then kallsyms_num_syms (4 bytes, equals the symbol count N), then names, markers, token table, and finally token_index at the end. offsets are nowhere near token_index.

in the new layout (v2, 6.6+), token_index sits right before offsets. token_index + 512 lands exactly on offsets. the v3 approach works because of this.

so for older kernels we need a different way to find offsets. without token_index as a shortcut, we look for a sorted u32 array that ends with the pattern: 8 bytes of _text followed by 4 bytes matching the array length. kind of like finding the signature of a packed struct.

the scan works in two phases. first, we check if the current page is entirely sorted:

int run = 0, prev = -1;
int max_i = (4096 - off) / 4;
for (int i = 0; i < max_i; i++) {
 unsigned int v = buf[(off + i * 4) / 4];
 if ((int)v < prev) break;
 prev = (int)v; run++;
}
if (run < max_i) continue;

only if the sorted run reaches the page boundary do we cross into safe_read territory. this filters out almost everything instantly.

then we verify the pattern:

if ((rb & ~0x1FFFFFULL) != kernel_base) continue;
if (ns != (unsigned int)run) continue;

the mask comparison on _text saves us from false negatives when the value is not exactly 2MB aligned across different builds.

kallsyms_seqs_of_names was added in kernel 6.1. 5.10 and 5.15 don’t have it. when it is missing, get_sym_seq() falls back to using the symbol index directly, which works because symbols are emitted in order.

took me a moment to realize why the scan kept failing on real devices. i had capped the sorted u32 run at the 4096 byte page boundary. one page is 1024 u32 entries, the threshold was 10000. the fix was cross page safe_read for any candidate that survived the first phase. simple.

kloffs @ ..., sorted=103903
layout v1, 103904 symbols
verify: addr->name MATCH
verify: name->addr MATCH

looks like it works on all three. 6.12 through v2, 6.6 through v2, 6.1 through v1. 5.10 and 5.15 builds pass CI.

Thanks to 汐の月 for providing the device for GKI 6.6 testing, and to 阿尔托莉雅·潘德拉贡 for providing the device for GKI 6.1 testing.

https://github.com/Dere3046/ksymless_Android

finding kallsyms with token_index

Thu, 02 Jul 2026 10:00:00 +0800

the first version relied on ADRP instruction scanning to find kallsyms data. worked on android16-6.12, not on android15-6.6. the ADRP window size depends on compiler inlining, which varies across kernel builds. not something you can hardcode.

the fix is simple. instead of chasing ADRP instructions, search for the token_index structure directly in kernel .rodata. its layout is determined by write_src() in scripts/kallsyms.c, identical in 6.6 and 6.12.

output_label("kallsyms_token_index");
for (i = 0; i < 256; i++)
 printf("\t.short\t%d\n", best_idx[i]);
// best_idx[i] = byte offset into token_table
// token_index[0] = 0, strictly increasing, 256 x u16

output_label("kallsyms_offsets");
for (i = 0; i < table_cnt; i++) {
 offset = table[i]->addr - relative_base;
 printf("\t.long\t%#x\n", (int)offset);
}

256 consecutive u16 values, strictly increasing, starting at 0. the chance of random rodata matching that is essentially zero.

once found, kallsyms_offsets is exactly 512 bytes after token_index (plus .balign 8 padding). the search stops naturally when copy_from_kernel_nofault hits unmapped pages. we start scanning at kernel_base + 1MB, which is well inside .text.

kernel_base = (unsigned long)&sprint_symbol & ~0x1FFFFFULL;

no ADRP scanning, no BL chain, no window sizes to guess. simple.

sorted=126031
SCT MATCH, addr->name MATCH, name->addr MATCH

that is it.

Thanks to 汐の月 for providing the device for GKI 6.6 testing.

https://github.com/Dere3046/ksymless_Android

ksymless Android

Fri, 19 Jun 2026 00:00:00 +0000

ARM64 port of ksymless. finds sys_call_table and reconstructs kallsyms_lookup_name on Android GKI without exported kernel symbols.

background

Since Linux 5.7 kallsyms_lookup_name is no longer exported. on Android GKI kernels this means kernel modules cannot look up symbols by name.

solution

the module starts from a single exported symbol (sprint_symbol) and rebuilds the full kallsyms lookup chain in 8 steps.

1. anchor

&sprint_symbol is a function pointer — the linker fills in the real address via R_AARCH64_ABS64 relocation. mask off the page offset to get the kernel base.

sprint_addr = (unsigned long)&sprint_symbol;
kernel_base = sprint_addr & ~0x1FFFFFULL;

2. sys_call_table

walk the x29 frame pointer chain out of the module init call. strip PAC signatures from return addresses. scan backwards for do_el0_svc frames.

inside do_el0_svc, the compiler emits an ADRP+ADD+B triplet to load sys_call_table:

unsigned long find_sct(struct fp_ret *frames, int nf)
{
 for (int i = nf - 1; i >= 0; i--) {
 unsigned long base = frames[i].addr - 128;
 scan_adrp_add(base, MAX_SCAN, adrps, MAX_ADRP);
 for (int j = 0; j < na; j++) {
 if (!adrps[j].has_b) continue;
 if (check_sct(adrps[j].target)) {
 sys_call_table_addr = adrps[j].target;
 return adrps[j].target;
 }
 }
 }
 return 0;
}

scan_adrp_add decodes the ARM64 instructions: ADRP extracts bits 21-16 of the page address, ADD supplies the page offset, and B gives the final target address of the instruction sequence after the ADRP+ADD pair.

3. BL chain

trace the BL (branch-and-link) instruction chain recursively from sprint_symbol. each BL instruction at offset i targets fn + i*4 + imm26*4. collect all visited functions (37 on this device).

int follow_bl(unsigned long fn, unsigned long *visited, int *nv_cnt, int depth)
{
 for (int i = 0; i < 256; i++) {
 unsigned int insn = bl_buf[i];
 if ((insn & 0xFC000000) != 0x94000000) continue;
 long imm26 = insn & 0x3FFFFFF;
 if (imm26 & 0x2000000) imm26 |= ~0x3FFFFFF;
 unsigned long tgt = fn + i * 4 + imm26 * 4;
 if (!is_ktxt(tgt)) continue;
 visited[(*nv_cnt)++] = tgt;
 follow_bl(tgt, visited, nv_cnt, depth - 1);
 }
}

4. ADRP pages

for each visited function, scan 256 instructions for ADRP instructions. extract the target page: (pc & ~0xFFF) + (imm << 12). collect 74 unique pages across all functions.

int collect_adrp_pages(unsigned long fn, unsigned long *pages, int max)
{
 for (int i = 0; i < 256 && n < max; i++) {
 unsigned int insn = buf[i];
 if ((insn & 0x9F000000) != 0x90000000) continue;
 unsigned long imm = ((insn >> 5) & 0x7FFFF) << 2 | ((insn >> 29) & 3);
 unsigned long page = ((fn + i * 4) & ~0xFFF) + (imm << 12);
 pages[n++] = page;
 }
}

5. find klbase

scan every ADRP page for an 8-byte value matching kernel_base. this value is kallsyms_relative_base (= _text).

for (int pi = 0; pi < total_pages && !klbase_addr; pi++) {
 for (int off = 0; off < 0x1000; off += 8) {
 unsigned long v;
 safe_read(&v, (void *)(page + off), 8);
 if (v == kernel_base) {
 klbase_addr = page + off;
 break;
 }
 }
}

6. find kloffs

kallsyms_offsets[0] is always 0 — the first symbol’s address equals kallsyms_relative_base. scan every 4-byte position in every ADRP page for a u32 value of 0.

verify each candidate by passing the first 4 offsets through sprint_symbol — the kernel’s own resolver. if any returns raw hex (0x...) instead of a symbol name, the candidate is rejected. sprint_symbol always returns the correct answer because it uses the kernel’s internal lookup path.

walk the sorted u32 sequence from each verified candidate. pick the one with the longest run. the real kallsyms_offsets has num_syms entries (126252 on these devices), unmatched by any other .rodata region.

// offsets[0] is always 0 (_text - relative_base)
if (v != 0) continue;

// sprint_symbol verify: first 4 offsets must resolve to real names
for (int i = 0; i < 4 && ok; i++) {
 sprint_symbol(name, klbase_val + read_u32(addr + i * 4));
 if (name[0] == '0' && name[1] == 'x')
 ok = 0; // sprint_symbol returned raw hex = no symbol here
}
if (!ok) continue;

// count consecutive sorted u32 entries, pick the longest
int len = 0, prev = -1;
for (int i = 0; i < 500000; i++) {
 unsigned int v = read_u32(addr + i * 4);
 if ((int)v < prev) break;
 prev = (int)v;
 len++;
}
if (len > best_len) { best_len = len; best_addr = addr; }

7. layout derivation

from the kernel source (scripts/kallsyms.c) the data structures are laid out in .rodata:

num_syms (4B)
names (compressed)
markers (u32 × ceil(num_syms/256))
token_table (256 null-terminated strings)
token_index (256 × u16 = 512B)
offsets (u32 × num_syms)
relative_base (u64)
seqs_of_names (3B × num_syms)

all addresses are derived from klbase and kloffs:

klnum_val = (klbase_addr - kloffs_addr) / 4; // num_syms
klindex_addr = kloffs_addr - 512; // token_index
klseqs_addr = klbase_addr + 8; // seqs_of_names

// find klnum_addr: match value == klnum_val in ADRP pages
// find kltable_addr: backward scan from token_index for 256 strings
// compute klmarks_addr and klnames_addr from layout

8. name lookup

implement both directions:

unsigned long kallsyms_name_to_addr(const char *name)
{
 int low = 0, high = (int)klnum_val - 1;
 while (low <= high) {
 int mid = low + (high - low) / 2;
 unsigned int seq = get_sym_seq(mid); // name-sorted -> original idx
 unsigned int off = get_sym_offset(seq); // idx -> names offset
 expand_sym(off, nbuf, sizeof(nbuf)); // decompress
 int r = strcmp(name, nbuf);
 if (r > 0) low = mid + 1;
 else if (r < 0) high = mid - 1;
 else return sym_addr(seq); // offsets[seq] + klbase
 }
 return 0;
}

verify with kprobe + sprint_symbol:

unsigned long test_addr = resolve("kallsyms_lookup_name");
sprint_symbol_no_offset(truth, test_addr);
sym_name_at(test_addr, our, sizeof(our)); // addr -> name
unsigned long lookup = kallsyms_name_to_addr(truth); // name -> addr

conclusion

full kallsyms lookup without any exported symbol dependency. sym_name_at and kallsyms_name_to_addr match kernel values on device.

repo

github.com/Dere3046/ksymless_Android

references

rota1001/ksymless — original x86_64 technique
xcellerator: linux rootkits 11 — kallsyms internals