So basically it was just made lame instead of detecting the addresses on its own. So if you took Brad's symbol location code from his released exploits and popped them into this you wouldn't need the kernel signatures as long as a system.map or kallsyms was detected.