1 files changed, 38 insertions, 1 deletions

diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs
index e6896f2..35f3464 100644
--- a/rsnix/src/memory.rs
+++ b/rsnix/src/memory.rs
@@ -91,7 +91,10 @@ pub fn set_kernel_image_range(base: usize, size: usize) {
     }
 }
 
-fn kernel_image_range() -> Option<(usize, usize)> {
+/// The loaded kernel image range `(start, end)`, if known.  Used to
+/// resolve fault RIPs against the symbol table and to filter stack
+/// scans for return addresses.
+pub fn kernel_image_range() -> Option<(usize, usize)> {
     unsafe {
         if KERNEL_IMAGE_END > KERNEL_IMAGE_START {
             Some((KERNEL_IMAGE_START, KERNEL_IMAGE_END))
@@ -101,6 +104,40 @@ fn kernel_image_range() -> Option<(usize, usize)> {
     }
 }
 
+/// The in-memory `.text` section range `(start, end)`, parsed from the
+/// loaded PE headers.  Used to filter fault backtraces: only code
+/// addresses are meaningful return addresses (the rest of the image
+/// range is .rdata/.data pointers).  Falls back to the full image
+/// range if the headers are unreadable.
+pub fn text_range() -> Option<(usize, usize)> {
+    let (base, _end) = kernel_image_range()?;
+    unsafe {
+        let base = base as *const u8;
+        if base.read() != b'M' || base.add(1).read() != b'Z' {
+            return kernel_image_range();
+        }
+        let e_lfanew = (base.add(0x3c) as *const u32).read() as usize;
+        let pe = base.add(e_lfanew);
+        if (pe as *const u32).read() != 0x4550 {
+            return kernel_image_range();
+        }
+        let fh = pe.add(4); // COFF file header (20 bytes)
+        let size_opt = (fh.add(16) as *const u16).read() as usize;
+        let nsec = (fh.add(2) as *const u16).read() as usize;
+        let sec = fh.add(20).add(size_opt);
+        for i in 0..nsec {
+            let s = sec.add(i * 40);
+            let nm = core::slice::from_raw_parts(s, 8);
+            if nm.starts_with(b".text") {
+                let vsz = (s.add(8) as *const u32).read() as usize;
+                let va = (s.add(12) as *const u32).read() as usize;
+                return Some((base as usize + va, base as usize + va + vsz));
+            }
+        }
+        kernel_image_range()
+    }
+}
+
 /// Minimum pages `grow_heap` takes from the page allocator per growth.
 const HEAP_GROW_PAGES: usize = 64;