-
Book Overview & Buying
-
Table Of Contents
Reverse Engineering Armv8-A Systems
By :
In the previous section, we determined the base address of the task_struct structure by identifying a specific magic value stored at the lowest address of the process stack.
In this section, we will explore a similar approach: finding a structure’s base address using a known function address. This method is particularly useful for analyzing kernel memory structures, making it a valuable technique for debugging and binary analysis.
In the Linux kernel, many data structures store function addresses to manage various operations dynamically. One example is the stack field in the task_struct structure, which we discussed in the previous section. In many cases, these function addresses serve as function pointers, which are used to invoke function calls during execution.
Now, we will analyze the address of an interrupt handler function and use it to determine the base address...