How to disassemble the running linux kernel?
Looking for a way to disassemble the running kernel. Can I do it th开发者_StackOverflow中文版rough /dev/kmem? I am running linux 2.6.32. Or can I use a kernel module to run through the kernel. I am beginner to this. Please help.
All I want to do is check the kernel image for some malicious module, by looking at the whether some specific instruction occured or not.
Try the Linux Kernel Debugger.
Update
As I said, try the Linux Kernel Debugger. Look in the linked article, about halfway down the page, where it says:
To disassemble instructions starting from the routine
schedule
. The number of lines displayed depends on the environment variableIDCOUNT
:
[0]kdb> id schedule
精彩评论