I am looking to debug a closed-source kernel module. The kernel is extremely old, v2.6.32. It was not compiled with CONFIG_KPROBES=y
, but was compiled with CONFIG_KALLSYMS
. I am looking to insert printk
statements at the entrypoint of a specific function in the kernel module. The function takes in a struct as a parameter, and I want to print out particular portions of the struct.
I have come up with the following idea:
- Compile a ‘debug’ kernel module that helps display the information I want. Then, jump from my ‘debug’ kernel module back to the original target kernel module function.
- Unload the target kernel module
- Byte-patch the first couple of instructions in the target kernel module function to call out a function in my debug kernel module
- Load my ‘debug’ kernel module and target kernel module
Since I don’t have a lot of experience with kernel debugging, I wanted to know if there were any easier methods of doing what I want.