1

I use pmap <pid> for inspecting the memory map of the user-space process <pid>.

How to inspect the memory map of the kernel given "root" privileges (i.e. all capabilities)?

The reason I'm interested is that I'm developing kernel modules, and thus would like to know which memory segment/section a symbol resides in.

Bonus:

Also, in order to obtain this information "offline", I've tried as follows:

$ sudo readelf -a /boot/vmlinuz-5.8.0-50-generic
readelf: Error: Not an ELF file - it has the wrong magic bytes at the start

But apparently, the Linux image is not in ELF format (why?).

How can I see the segments/sections of the kernel image?

Shuzheng
  • 4,023
  • 1
  • 31
  • 71
  • Do you have a file `/proc/kallsyms`? This has all the kernel symbols. As `root` you should be able to see the addresses. I am not sure what you mean by segments/sections. – icarus May 09 '21 at 05:35
  • @icarus - Yes, I got full access to `/proc/kallsyms`. AFAIK, the kernel is in ELF format, which contains segments/sections that are mapped into memory with different permissions, e.g RX. I want to see these sections, since sometimes I get the kernel’s version of a SIGSEG meaning that I accessed non-mapped memory. IOW, I look for an overview like what `pmap` provides for user-space processes. – Shuzheng May 09 '21 at 05:41

0 Answers0