diff --git a/apps/plugins/chessbox/chessbox.make b/apps/plugins/chessbox/chessbox.make
index 7fa0598eb9..0567392cbc 100644
--- a/apps/plugins/chessbox/chessbox.make
+++ b/apps/plugins/chessbox/chessbox.make
@@ -32,7 +32,7 @@ $(CHESSBOX_OBJDIR)/chessbox.refmap: $(CHESSBOX_OBJ)
 
 $(CHESSBOX_OUTLDS): $(PLUGIN_LDS) $(CHESSBOX_OBJDIR)/chessbox.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(CHESSBOX_OBJDIR)/chessbox.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(CHESSBOX_OBJDIR)/chessbox.refelf))
 
 $(CHESSBOX_OBJDIR)/chessbox.ovl: $(CHESSBOX_OBJ) $(CHESSBOX_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
diff --git a/apps/plugins/goban/goban.make b/apps/plugins/goban/goban.make
index 160cfdf1ad..8a6e55582b 100644
--- a/apps/plugins/goban/goban.make
+++ b/apps/plugins/goban/goban.make
@@ -29,7 +29,7 @@ $(GOBAN_BUILDDIR)/goban.refmap: $(GOBAN_OBJ)
 
 $(GOBAN_OUTLDS): $(PLUGIN_LDS) $(GOBAN_BUILDDIR)/goban.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(GOBAN_BUILDDIR)/goban.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(GOBAN_BUILDDIR)/goban.refelf))
 
 $(GOBAN_BUILDDIR)/goban.ovl: $(GOBAN_OBJ) $(GOBAN_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
diff --git a/apps/plugins/imageviewer/imageviewer.make b/apps/plugins/imageviewer/imageviewer.make
index 37b2e6ff8d..ceb164b627 100644
--- a/apps/plugins/imageviewer/imageviewer.make
+++ b/apps/plugins/imageviewer/imageviewer.make
@@ -44,11 +44,11 @@ $(IMGVBUILDDIR)/%.ovl: $(IMGDEC_OUTLDS)
 
 # rule to create reference map for image decoder
 $(IMGVBUILDDIR)/%.refmap: $(APPSDIR)/plugin.h $(IMGVSRCDIR)/imageviewer.h $(PLUGINLINK_LDS) $(PLUGIN_LIBS)
-	$(call PRINTS,LD $(@F))$(CC) $(IMGDECFLAGS) -o /dev/null \
+	$(call PRINTS,LD $(@F))$(CC) $(IMGDECFLAGS) -o $(IMGVBUILDDIR)/$*.refelf \
 		$(filter %.o, $^) \
 		$(filter %.a, $+) \
 		-lgcc $(IMGDECLDFLAGS)
 
 $(IMGVBUILDDIR)/%.link: $(PLUGIN_LDS) $(IMGVBUILDDIR)/%.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DIMGVDECODER_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(IMGVBUILDDIR)/$*.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(IMGVBUILDDIR)/$*.refelf))
diff --git a/apps/plugins/lua/lua.make b/apps/plugins/lua/lua.make
index 7ca05c15d1..52311976ab 100644
--- a/apps/plugins/lua/lua.make
+++ b/apps/plugins/lua/lua.make
@@ -66,7 +66,7 @@ $(LUA_BUILDDIR)/lua.refmap: $(LUA_OBJ) $(TLSFLIB)
 
 $(LUA_OUTLDS): $(PLUGIN_LDS) $(LUA_BUILDDIR)/lua.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(LUA_BUILDDIR)/lua.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(LUA_BUILDDIR)/lua.refelf))
 
 $(LUA_BUILDDIR)/lua.ovl: $(LUA_OBJ) $(TLSFLIB) $(LUA_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
diff --git a/apps/plugins/pictureflow/pictureflow.make b/apps/plugins/pictureflow/pictureflow.make
index eb19eaacf0..dc7fe89291 100644
--- a/apps/plugins/pictureflow/pictureflow.make
+++ b/apps/plugins/pictureflow/pictureflow.make
@@ -30,7 +30,7 @@ $(PICTUREFLOW_OBJDIR)/pictureflow.refmap: $(PICTUREFLOW_OBJ)
 
 $(PICTUREFLOW_OUTLDS): $(PLUGIN_LDS) $(PICTUREFLOW_OBJDIR)/pictureflow.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(PICTUREFLOW_OBJDIR)/pictureflow.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(PICTUREFLOW_OBJDIR)/pictureflow.refelf))
 
 $(PICTUREFLOW_OBJDIR)/pictureflow.ovl: $(PICTUREFLOW_OBJ) $(PICTUREFLOW_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
diff --git a/apps/plugins/plugin.lds b/apps/plugins/plugin.lds
index 14a36f8283..2988109b69 100644
--- a/apps/plugins/plugin.lds
+++ b/apps/plugins/plugin.lds
@@ -310,6 +310,9 @@ SECTIONS
     	plugin_load_end_addr = .;
     }
 
+    _plugin_ram_end = ORIGIN(PLUGIN_RAM) + LENGTH(PLUGIN_RAM);
+    plugin_ram_end = ORIGIN(PLUGIN_RAM) + LENGTH(PLUGIN_RAM);
+
     /* Special trick to avoid a linker error when no other sections are
        left after garbage collection (plugin not for this platform) */
     .comment 0 :
diff --git a/apps/plugins/plugins.make b/apps/plugins/plugins.make
index db414059d3..9e85fbbd1a 100644
--- a/apps/plugins/plugins.make
+++ b/apps/plugins/plugins.make
@@ -183,7 +183,7 @@ $(BUILDDIR)/apps/plugins/%.lua: $(ROOTDIR)/apps/plugins/%.lua
 	$(call PRINTS,CP $(subst $(ROOTDIR)/,,$<))cp $< $(BUILDDIR)/apps/plugins/
 
 $(BUILDDIR)/%.refmap: $(APPSDIR)/plugin.h $(OVERLAYREF_LDS) $(PLUGIN_LIBS) $(PLUGIN_CRT0)
-	$(call PRINTS,LD $(@F))$(CC) $(PLUGINFLAGS) -o /dev/null \
+	$(call PRINTS,LD $(@F))$(CC) $(PLUGINFLAGS) -o $(basename $@).refelf \
 		$(filter %.o, $^) \
 		$(filter %.a, $+) \
 		-lgcc $(OVERLAYLDFLAGS)
diff --git a/apps/plugins/rockboy/rockboy.make b/apps/plugins/rockboy/rockboy.make
index 190f1ac59f..c0174e8331 100644
--- a/apps/plugins/rockboy/rockboy.make
+++ b/apps/plugins/rockboy/rockboy.make
@@ -30,7 +30,7 @@ $(ROCKBOY_OBJDIR)/rockboy.refmap: $(ROCKBOY_OBJ)
 
 $(ROCKBOY_OUTLDS): $(PLUGIN_LDS) $(ROCKBOY_OBJDIR)/rockboy.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(ROCKBOY_OBJDIR)/rockboy.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(ROCKBOY_OBJDIR)/rockboy.refelf))
 
 $(ROCKBOY_OBJDIR)/rockboy.ovl: $(ROCKBOY_OBJ) $(ROCKBOY_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
diff --git a/apps/plugins/sdl/sdl.make b/apps/plugins/sdl/sdl.make
index f04f727aa7..358de80b19 100644
--- a/apps/plugins/sdl/sdl.make
+++ b/apps/plugins/sdl/sdl.make
@@ -71,7 +71,7 @@ $(SDL_OBJDIR)/duke3d.refmap: $(SDL_OBJ) $(DUKE3D_OBJ) $(TLSFLIB)
 
 $(DUKE3D_OUTLDS): $(PLUGIN_LDS) $(SDL_OBJDIR)/duke3d.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(SDL_OBJDIR)/duke3d.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(SDL_OBJDIR)/duke3d.refelf))
 
 $(SDL_OBJDIR)/duke3d.ovl: $(SDL_OBJ) $(DUKE3D_OBJ) $(TLSFLIB) $(DUKE3D_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
@@ -88,7 +88,7 @@ $(SDL_OBJDIR)/wolf3d.refmap: $(SDL_OBJ) $(WOLF3D_OBJ) $(TLSFLIB)
 
 $(WOLF3D_OUTLDS): $(PLUGIN_LDS) $(SDL_OBJDIR)/wolf3d.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(SDL_OBJDIR)/wolf3d.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(SDL_OBJDIR)/wolf3d.refelf))
 
 $(SDL_OBJDIR)/wolf3d.ovl: $(SDL_OBJ) $(WOLF3D_OBJ) $(TLSFLIB) $(WOLF3D_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
@@ -106,7 +106,7 @@ $(SDL_OBJDIR)/quake.refmap: $(SDL_OBJ) $(QUAKE_OBJ) $(TLSFLIB)
 
 $(QUAKE_OUTLDS): $(PLUGIN_LDS) $(SDL_OBJDIR)/quake.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(SDL_OBJDIR)/quake.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(SDL_OBJDIR)/quake.refelf))
 
 $(SDL_OBJDIR)/quake.ovl: $(SDL_OBJ) $(QUAKE_OBJ) $(TLSFLIB) $(QUAKE_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
diff --git a/apps/plugins/zxbox/zxbox.make b/apps/plugins/zxbox/zxbox.make
index 53c7232405..700d8a9c91 100644
--- a/apps/plugins/zxbox/zxbox.make
+++ b/apps/plugins/zxbox/zxbox.make
@@ -38,7 +38,7 @@ $(ZXBOX_OBJDIR)/zxbox.refmap: $(ZXBOX_OBJ)
 
 $(ZXBOX_OUTLDS): $(PLUGIN_LDS) $(ZXBOX_OBJDIR)/zxbox.refmap
 	$(call PRINTS,PP $(@F))$(call preprocess2file,$<,$@,-DPLUGIN -DOVERLAY_OFFSET=$(shell \
-		$(TOOLSDIR)/ovl_offset.pl $(ZXBOX_OBJDIR)/zxbox.refmap))
+		$(TOOLSDIR)/ovl_offset.pl $(ZXBOX_OBJDIR)/zxbox.refelf))
 
 $(ZXBOX_OBJDIR)/zxbox.ovl: $(ZXBOX_OBJ) $(ZXBOX_OUTLDS)
 	$(SILENT)$(CC) $(PLUGINFLAGS) -o $(basename $@).elf \
diff --git a/tools/ovl_offset.pl b/tools/ovl_offset.pl
index 12777582cd..440606bbd1 100755
--- a/tools/ovl_offset.pl
+++ b/tools/ovl_offset.pl
@@ -1,35 +1,39 @@
 #!/usr/bin/perl
 
 # Calculate the highest possible location for an overlay based
-# on a reference map file (.refmap)
+# on a reference ELF file (.refelf)
+# Reads plugin_load_end_addr and plugin_ram_end symbols from the ELF
+# via nm, then computes the overlay offset.
 
-sub map_scan {
+sub main {
     # The buflib handle table is a few hundred bytes, just before
     # the plugin buffer. We assume it's never more than 1024 bytes.
     # If this assumption is wrong, overlay loading will fail.
     my $max_handle_table_size = 1024;
-    my ($map) = @_;
-    my $ramstart = -1, $ramsize = -1, $startaddr = -1, $endaddr = -1;
-    open (MAP, "<$map");
-    while (<MAP>) {
-        if ($_ =~ /^PLUGIN_RAM +0x([0-9a-f]+) +0x([0-9a-f]+)$/) {
-            $ramstart = hex($1);
-            $ramsize = hex($2);
+
+    my ($elf) = @_;
+    my $ram_end = -1;
+    my $load_end = -1;
+
+    open (NM, "nm $elf |") or die "Cannot run nm on $elf: $!\n";
+    while (<NM>) {
+        if ($_ =~ /^([0-9a-fA-F]+)\s+\S+\s+plugin_ram_end$/) {
+            $ram_end = hex($1);
         }
-        elsif ($_ =~ / +0x([0-9a-f]+) +_?plugin_start_addr = ./) {
-            $startaddr = hex($1);
-        }
-        elsif ($_ =~ / +0x([0-9a-f]+) +_?plugin_load_end_addr = ./) {
-            $endaddr = hex($1);
+        elsif ($_ =~ /^([0-9a-fA-F]+)\s+\S+\s+plugin_load_end_addr$/) {
+            $load_end = hex($1);
         }
     }
-    close (MAP);
-    if ($ramstart < 0 || $ramsize < 0 || $startaddr < 0 || $endaddr < 0
-        || $ramstart != $startaddr) {
-        printf "Could not analyze map file.\n";
+    close(NM);
+
+    if ($ram_end < 0 || $load_end < 0) {
+        printf STDERR "Could not read symbols from $elf\n";
+        printf STDERR "  plugin_ram_end: %s\n", $ram_end < 0 ? "not found" : sprintf("0x%x", $ram_end);
+        printf STDERR "  plugin_load_end_addr: %s\n", $load_end < 0 ? "not found" : sprintf("0x%x", $load_end);
         exit 1;
     }
-    return $ramstart + $ramsize - $endaddr - $max_handle_table_size;
+
+    return ($ram_end - $load_end - $max_handle_table_size) & ~0xf;
 }
 
-printf map_scan($ARGV[0]) & ~0xf;
+printf main($ARGV[0]);