I would like to debug a loaded kernel module I don't have the source code to; I suspect it's a virus. Is there a way to feed it into GDB for analysis?

  • You mean virus?
    – phunehehe
    Jan 10, 2011 at 11:25
  • Its something I suspect a rootkit. I just want to dissamble it for the purpose of analysis
    – user3539
    Jan 10, 2011 at 16:22

2 Answers 2


From a debugging perspective, the kernel is a special "process", distinct from the user space processes, which communicate with the kernel via a sort of rpc mechanism (syscalls) or mapped memory..

I don't think you can see the kernel's data structure simply by inspecting some random user process.

Another problem is, that every user space process (including the debugger) needs the kernel to run and to communicate with the users; I don't think you can just stop the kernel and believe that the debugger will continue to run.

So you need to run GDB on a second machine, and that is what is called Kernel debugging.
Please refer to (http://kgdb.linsyssoft.com/, Documentation/sh/kgdb) for more details.

  • I think my question is not clear. Sorry for the confusion. I want to debug the inserted module, whose source i dont have with me.
    – user3539
    Jan 10, 2011 at 16:21
  • You might be able to look at the kernel code through creative use of /dev/kmem if it's enabled on your system. You'd have to get the address of the module beforehand and I don't know how to do that.
    – LawrenceC
    May 10, 2011 at 18:42

The other options other then KGDB would be debugging the kernel using the QEMU and GDB. Unlike the KGDB, the QEMU-GDB combine requires only a single machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .