D265
- obscene-tool vaddrs: exports resolved to names, in the
tool not a script
orbistoun-firmware lays libkernel's exports out at their
measured vaddrs, so a payload's base + offset arithmetic
lands on a reimplementation of the named function. It keys those by
human name - its parser splits name vaddr,
and its anchors are getpid/GETPID_VADDR. But
an export table stores each symbol by its NID, a hash
of the name, so the raw dump is HoLVWNanBBc#I#A 0x5b0, not
getpid 0x5b0. Turning one into the other is a join of two
facts, and it belongs in the tooling: the table is
regenerated whenever the firmware moves, and a throwaway script is
neither repeatable nor documented.
So
obscene-tool vaddrs <module> --source <label>:
- reads the exports through SELFish (
dynamic::symbols), keeping every symbol with a section (defined here, not imported) and a nonzero value - the measured half; - decodes each export's NID and looks the raw value up in
data/mined-names.txt- the corpus half. That is why this lives in obSCEne and not SELFish: SELFish holds the hash algorithm and, deliberately, not the mined corpus (SELFish D086), so it cannot name a NID. SELFish'slibkernel_vaddrsexample is the raw NID→vaddr form, and proves the vaddr measurement without any corpus.
An export whose NID the corpus does not know keeps its encoded NID as
the name - the honest statement that the name is not yet known (§7), and
exactly what a consumer's naming workflow resolves later; no vaddr is
dropped. On 12.40 that is 1,867 exports, 1,644 named. The two
provenances stay separable: the vaddr is measured, the name
is whatever the corpus row's sources make it, and the file's header
records both. The output is a data file a consumer vendors - orbistoun's
crates/orbistoun-firmware/data/libkernel-vaddrs.txt is
generated by this command. Status: done.