how can you get the offset

[Badangel]

I want to make vmi in ubuntu16.04, but the kernel is 4.4.0-57. I don't know how to get the kernel struct offset. If the ubuntu website release or should get by myself?
Can you tell me? thank you!

[sahilsuneja1]

Try the create_offset_file() function at https://github.com/cloudviz/psvmi/blob/master/tests/test.sh#L8
You would need to find vmlinux for 4.4.0-57, and replace it's url in the wget in that function.
@ricarkol

[ricarkol]

Yes, the trick is to find the vmlinux for that exact same kernel that you are using. If it's ubuntu, there should be a package that has the vmlinux, usually something like linux-image-4.4-blabla-debug.

Also, be sure that it is a vmlinux (with debug symbols) and not a vmlinuz file.

[Badangel]

The system is ubuntu16.04LTS. I have got the System.map-4.4.0-57-generic which is already in the system(in file named boot). Can I get offset from it? Or the offset in your project only can get from vmlinux. I need the offset in task_struct, files_struct, fdtable, socket and so on to make vmi.
I can't find vmlinux for 4.4.0-57, whether I can get it from vmlinuz, or it must exist just I haven't found it.
I find linux-image-4.4.0-57-generic_4.4.0-57.78_amd64.deb, is it the same as vmlinux for 4.4.0-57?
Sorry, I am a green hand in this side with too many question.

[sahilsuneja1]

You need vmlinux for offsets, vmlinuz won't suffice.
Try the dbgsym package here: https://launchpad.net/ubuntu/xenial/+package/linux-image-4.4.0-57-generic-dbgsym
Another way of installing directly from the repo: https://wiki.ubuntu.com/Debug%20Symbol%20Packages
Then extract and find vmlinux in there. Maybe the following would still work:
command to extract: dpkg -x xx-dbgsym <targte_directory>
the vmlinux object file can be found in <target_directory>/usr/lib/debug/lib/modules/<uname -r>