5

I would like to debug a loaded kernel module I don't have the source code to; I suspect it's a virus. Is there a way to feed it into GDB for analysis?

  • You mean virus? – phunehehe Jan 10 '11 at 11:25
  • Its something I suspect a rootkit. I just want to dissamble it for the purpose of analysis – user3539 Jan 10 '11 at 16:22
5

From a debugging perspective, the kernel is a special "process", distinct from the user space processes, which communicate with the kernel via a sort of rpc mechanism (syscalls) or mapped memory..

I don't think you can see the kernel's data structure simply by inspecting some random user process.

Another problem is, that every user space process (including the debugger) needs the kernel to run and to communicate with the users; I don't think you can just stop the kernel and believe that the debugger will continue to run.

So you need to run GDB on a second machine, and that is what is called Kernel debugging.
Please refer to (http://kgdb.linsyssoft.com/, Documentation/sh/kgdb) for more details.

  • I think my question is not clear. Sorry for the confusion. I want to debug the inserted module, whose source i dont have with me. – user3539 Jan 10 '11 at 16:21
  • You might be able to look at the kernel code through creative use of /dev/kmem if it's enabled on your system. You'd have to get the address of the module beforehand and I don't know how to do that. – LawrenceC May 10 '11 at 18:42
0

The other options other then KGDB would be debugging the kernel using the QEMU and GDB. Unlike the KGDB, the QEMU-GDB combine requires only a single machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.