开发者

How to disassemble the running linux kernel?

Looking for a way to disassemble the running kernel. Can I do it th开发者_StackOverflow中文版rough /dev/kmem? I am running linux 2.6.32. Or can I use a kernel module to run through the kernel. I am beginner to this. Please help.

All I want to do is check the kernel image for some malicious module, by looking at the whether some specific instruction occured or not.


Try the Linux Kernel Debugger.

Update

As I said, try the Linux Kernel Debugger. Look in the linked article, about halfway down the page, where it says:

To disassemble instructions starting from the routine schedule. The number of lines displayed depends on the environment variable IDCOUNT:

[0]kdb> id schedule
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜