D268 - On-console libkernel export table enumeration replaces offline sprx dumps
The libkernel vaddr table
(orbistoun-firmware/data/libkernel-vaddrs.txt, 1,867
entries) was previously produced by reading the real 12.40
libkernel_sys.sprx: selfish's
libkernel_vaddrs example dumped
(encoded-NID, vaddr) from the file's .dynsym,
and obscene-tool vaddrs resolved NIDs to names via the
mined corpus (data/mined-names.txt). While functional, that
workflow depended on pulling decrypted firmware files onto developer
machines.
The Shift: Live In-Memory Enumeration
Under an unsandboxed elfldr payload,
libkernel is mapped directly in the process address space
at obs_libkernel_base(). Instead of confirming only a
handful of hardcoded candidate addresses behaviorally
(139-exports/confirm), 139-exports/enumerate
walks libkernel's in-memory PT_DYNAMIC segment
-> .dynsym and .dynstr directly at
runtime.
For every defined export
(st_shndx != 0 && st_value != 0),
139-exports/enumerate emits:
OBS|measure|139-exports/enumerate|<encoded-NID>|vaddr|0x<st_value>|offset
Streaming these measurements out over the report channel allows
obscene-tool vaddrs to ingest the live console report and
resolve NIDs against data/mined-names.txt.
Provenance Boundaries Preserved
Nothing vendor-derived is committed to the repository:
- Virtual address offsets (
vaddr) are measurements of the running system on real hardware. - Symbol names come strictly from
obscene's own mined corpus (data/mined-names.txt). - The offline
.sprxdump is retired, making a jailbroken console runningobscenethe sole, definitive source of truth for thelibkernelvaddr table.
Status: done.