Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to debug a loaded kernel module I don't have the source code to; I suspect it's a virus. Is there a way to feed it into GDB for analysis?

share|improve this question
    
You mean virus? –  phunehehe Jan 10 '11 at 11:25
    
Its something I suspect a rootkit. I just want to dissamble it for the purpose of analysis –  user3539 Jan 10 '11 at 16:22

2 Answers 2

up vote 3 down vote accepted

From a debugging perspective, the kernel is a special "process", distinct from the user space processes, which communicate with the kernel via a sort of rpc mechanism (syscalls) or mapped memory..

I don't think you can see the kernel's data structure simply by inspecting some random user process.

Another problem is, that every user space process (including the debugger) needs the kernel to run and to communicate with the users; I don't think you can just stop the kernel and believe that the debugger will continue to run.

So you need to run GDB on a second machine, and that is what is called Kernel debugging.
Please refer to (http://kgdb.linsyssoft.com/, Documentation/sh/kgdb) for more details.

share|improve this answer
    
I think my question is not clear. Sorry for the confusion. I want to debug the inserted module, whose source i dont have with me. –  user3539 Jan 10 '11 at 16:21
    
You might be able to look at the kernel code through creative use of /dev/kmem if it's enabled on your system. You'd have to get the address of the module beforehand and I don't know how to do that. –  ultrasawblade May 10 '11 at 18:42

The other options other then KGDB would be debugging the kernel using the QEMU and GDB. Unlike the KGDB, the QEMU-GDB combine requires only a single machine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.