I took the kernel code from the memory and the zmlinuz (vmlinuz) file from the disk. I decompressed the vmlinuz to elf file and I compared the code sections of the memory and the disk files. I found that the code in the memory has changed a little bit. The changes between the code in memory and the code on the disk were pointers to strings. The change is indicated in the following image in the red square:
The value "02 82" changed to "62 a8".
The offset of all code changes was fixed (0x6026). I'm trying to figure out why the change is happening? Is there a mapping in the elf file to all the places that made this change? How does the kernel loader know where to make the change of address?
Thank you
