How to debug an inserted kernel module?

Question

I would like to debug a loaded kernel module I don't have the source code to; I suspect it's a virus. Is there a way to feed it into GDB for analysis?

Answer 1

From a debugging perspective, the kernel is a special "process", distinct from the user space processes, which communicate with the kernel via a sort of rpc mechanism (syscalls) or mapped memory..

I don't think you can see the kernel's data structure simply by inspecting some random user process.

Another problem is, that every user space process (including the debugger) needs the kernel to run and to communicate with the users; I don't think you can just stop the kernel and believe that the debugger will continue to run.

So you need to run GDB on a second machine, and that is what is called Kernel debugging.
Please refer to (http://kgdb.linsyssoft.com/, Documentation/sh/kgdb) for more details.

Answer 2

The other options other then KGDB would be debugging the kernel using the QEMU and GDB. Unlike the KGDB, the QEMU-GDB combine requires only a single machine.