sym_offset calculation in attach uprobe fails to account to address differences

[ajwerner]

BPF probes want the offset of a symbol in the object file. In shared object and executable files, at least, the current logic seems to return the virtual address of the symbol as opposed to the offset in the object file.

The st_value for a goblin::elf:sym::Sym with st_info of STT_FUNC (2) refers to the virtual memory address. In order to compute the offset, one needs to find the offset by translating it to be relative to the address of the section containing the symbol and then adding the offset of the section in the file.

The offending code is:

redbpf/redbpf/src/lib.rs

Line 965 in 5533198

.st_value

In some cases, the address of the symbol is its offset, but certainly not in all cases.

See: bpftrace/bpftrace#1763 (comment)

[ajwerner]

Fixed by #308; would it be possible to release a new version containing this fix?