Hi, I need to use some unexported kernel symbols in my kernel module but in the particular kernel version i am based on (2.6.18 - RHEL 5.7), kallsyms_lookup_name is not exported and there is no kallsyms_on_each_symbol in this kernel. And I can't change the kernel owing to reasons i have no control over. In this scenario, how do i use unexported symbols. Is there any other mechanism by which i can lookup the address of a kernel symbol. Thanks. Venkatram
On Sat, Aug 6, 2011 at 12:55, Venkatram Tummala <venkatram867@gmail.com> wrote:
Hi,
I need to use some unexported kernel symbols in my kernel module but in the particular kernel version i am based on (2.6.18 - RHEL 5.7), kallsyms_lookup_name is not exported and there is no kallsyms_on_each_symbol in this kernel. And I can't change the kernel owing to reasons i have no control over.
In this scenario, how do i use unexported symbols. Is there any other mechanism by which i can lookup the address of a kernel symbol.
I think it's a bit dirty, but how about scanning the kernel ".text" area and find the start of "code fingerprint" of kallsyms_on_each_symbol? What I meant by fingerprint is actually few first bytes of the function, likely ones that did stack pop and does initial looping. Or if possible, use debuginfo repository and use the debug symbols to see where the symbol is located. Then do direct "call". Just a thought.... -- regards, Mulyadi Santosa Freelance Linux trainer and consultant blog: the-hydra.blogspot.com training: mulyaditraining.blogspot.com
On Sat, Aug 6, 2011 at 11:06 AM, Mulyadi Santosa <mulyadi.santosa@gmail.com>wrote:
On Sat, Aug 6, 2011 at 12:55, Venkatram Tummala <venkatram867@gmail.com> wrote:
Hi,
I need to use some unexported kernel symbols in my kernel module but in the particular kernel version i am based on (2.6.18 - RHEL 5.7), kallsyms_lookup_name is not exported and there is no kallsyms_on_each_symbol in this kernel. And I can't change the kernel owing to reasons i have no control over.
In this scenario, how do i use unexported symbols. Is there any other mechanism by which i can lookup the address of a kernel symbol.
You can: - grep kallsyms_lookup from /proc/kallsyms (it is there on SL 5.5 and SL 6.0. You can edit your program and assign something like: int (*my_kallsyms_lookup_name)(const char *name) = (void *) KALLSYMS; where KALLSYMS is address found above, or your loading script can feed this address. if your kernel is compiled with kprobe, you can use it to get address too.
On Sun, Aug 7, 2011 at 4:03 PM, Abu Rasheda <rcpilot2010@gmail.com> wrote:
On Sat, Aug 6, 2011 at 11:06 AM, Mulyadi Santosa < mulyadi.santosa@gmail.com> wrote:
On Sat, Aug 6, 2011 at 12:55, Venkatram Tummala <venkatram867@gmail.com> wrote:
Hi,
I need to use some unexported kernel symbols in my kernel module but in the particular kernel version i am based on (2.6.18 - RHEL 5.7), kallsyms_lookup_name is not exported and there is no kallsyms_on_each_symbol in this kernel. And I can't change the kernel owing to reasons i have no control over.
In this scenario, how do i use unexported symbols. Is there any other mechanism by which i can lookup the address of a kernel symbol.
You can:
- grep kallsyms_lookup from /proc/kallsyms (it is there on SL 5.5 and SL 6.0. You can edit your program and assign something like:
int (*my_kallsyms_lookup_name)(const char *name) = (void *) KALLSYMS;
where KALLSYMS is address found above, or your loading script can feed this address.
This is what i am currently doing but i need a cleaner way of doing this. if your kernel is compiled with kprobe, you can use it to get address too.
How do i do it using kprobes? To register a kprobe, i need the address of kallsyms_lookup_name which is what i want in the first place. Venkatram
- grep kallsyms_lookup from /proc/kallsyms (it is there on SL 5.5 and SL
6.0. You can edit your program and assign something like:
int (*my_kallsyms_lookup_name)(const char *name) = (void *) KALLSYMS;
where KALLSYMS is address found above, or your loading script can feed this address.
This is what i am currently doing but i need a cleaner way of doing this.
Sometime, this is only thing you have, and this is pretty clean. You can write a script, which could pass module parameter for the address of the function.
if your kernel is compiled with kprobe, you can use it to get address too.
How do i do it using kprobes? To register a kprobe, i need the address of kallsyms_lookup_name which is what i want in the first place.
I think following should work. struct kprobe kp; memset(&kp, 0, sizeof(kp)); kp.symbol_name = "kallsyms_lookup_name"; if (!register_kprobe(&kp)) { my_kallsyms_lookup_name = (void *) kp.addr; unregister_kprobe(&kp); }
On Mon, Aug 8, 2011 at 11:21 AM, Abu Rasheda <rcpilot2010@gmail.com> wrote:
- grep kallsyms_lookup from /proc/kallsyms (it is there on SL 5.5 and SL
6.0. You can edit your program and assign something like:
int (*my_kallsyms_lookup_name)(const char *name) = (void *) KALLSYMS;
where KALLSYMS is address found above, or your loading script can feed this address.
This is what i am currently doing but i need a cleaner way of doing this.
Sometime, this is only thing you have, and this is pretty clean. You can write a script, which could pass module parameter for the address of the function.
if your kernel is compiled with kprobe, you can use it to get address too.
How do i do it using kprobes? To register a kprobe, i need the address of kallsyms_lookup_name which is what i want in the first place.
I think following should work.
struct kprobe kp;
memset(&kp, 0, sizeof(kp)); kp.symbol_name = "kallsyms_lookup_name"; if (!register_kprobe(&kp)) { my_kallsyms_lookup_name = (void *) kp.addr; unregister_kprobe(&kp); }
Thanks. This is what i needed. Worked like a charm.!
participants (3)
-
Abu Rasheda -
Mulyadi Santosa -
Venkatram Tummala