debugginglinux-kernelkernel-module

Debugging a closed-source kernel module with CONFIG_KPROBES turned off


I am looking to debug a closed-source kernel module. The kernel is extremely old, v2.6.32. It was not compiled with CONFIG_KPROBES=y, but was compiled with CONFIG_KALLSYMS. I am looking to insert printk statements at the entrypoint of a specific function in the kernel module. The function takes in a struct as a parameter, and I want to print out particular portions of the struct.

I have come up with the following idea:

  1. Compile a 'debug' kernel module that helps display the information I want. Then, jump from my 'debug' kernel module back to the original target kernel module function.
  2. Unload the target kernel module
  3. Byte-patch the first couple of instructions in the target kernel module function to call out a function in my debug kernel module
  4. Load my 'debug' kernel module and target kernel module

Since I don't have a lot of experience with kernel debugging, I wanted to know if there were any easier methods of doing what I want.


Solution

  • The idea you came up with sounds fine. It's basically what kprobes does under the hood. You will have to be careful but it's definitely doable.

    Another option would be to compile the exact same kernel (extracting the config of the one you have, which I assume you do have since you are compiling other modules for it) and load the module there. This "debug" kernel could be enhanced with debugging or by changing the module loading code to hook things for you when it sees the module you want to debug.

    Finally, you could try running the target kernel and module under QEMU, then debug it with GDB through QEMU debugging interface. If you manage to set it up, this is probably the most comfortable scenario.