search

0xricksanchez / like-dbg

Fully dockerized Linux kernel debugging environment
MIT License
731 stars 58 forks source link

Load symbols for kernel module to allow natural debugging by symbol names #137

Open usiegj00 opened 1 year ago

usiegj00 commented 1 year ago

Currently, a debugging session starts with symbols unmapped to addresses. This limits ease of debugging and operations like b some_func are not available.

Typically, this is solved by finding the symbol offsets from an active kernel module and then loading a symbol file like:

# On debugee:
cat /sys/module/the_mod/sections/.text
cat /sys/module/the_mod/sections/.data
cat /sys/module/the_mod/sections/.bss
# On debuger:
add-symbol-file the_mod.ko 0xffffffff... -s .data 0xffffffff... -s .bss 0xffffffff...

Or alternatively using /proc/kallsyms.

A workaround could be made if #71 were available because a kernel module could be easily uploaded and the rest orchestrated.

0xricksanchez commented 1 year ago

It may be worth looking into something like this: https://github.com/marin-m/vmlinux-to-elf/blob/master/vmlinux_to_elf/kallsyms_finder.py