2

The header is self explanatory but to explain my self better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the init function. Can i find this info using "readelf" ?

Thanks,

  • 1
    For example, lwn.net/Articles/531148 Also, module_init is not a real function, it's a macro as described in that article. – Vitaly Osipov Jul 14 '16 at 9:36
  • @TakashiYamamoto: Tell me if I am wrong, but I always thought that the init_module() function was located at the start of the module address... Have you examples where it is not the case? I am interested to know about! – perror Aug 27 '17 at 14:25
2

To read with readelf the parameter is "-s":

 Options are:
    -a --all               Equivalent to: -h -l -S -s -r -d -V -A -I
    -h --file-header       Display the ELF file header
    -l --program-headers   Display the program headers
        --segments          An alias for --program-headers
    -S --section-headers   Display the sections' header
       --sections          An alias for --section-headers
    -g --section-groups    Display the section groups
    -t --section-details   Display the section details
    -e --headers           Equivalent to: -h -l -S
    -s --syms              Display the symbol table
       --symbols           An alias for --syms
    --dyn-syms             Display the dynamic symbol table
    -n --notes             Display the core notes (if present)

So, with readelf -s module.ko is enough to read the symbols.

-2

First disassemble your module

objdump -xDsl module.ko > disassemble.txt

Then edit the file and search for section init. It look like this:

Disassembly of section .init.text:

002bdb01 : init_fct():

  • This answer looks like it has great potential for improvement. @laurent can I suggest you edit it to elaborate a bit more? – NirIzr Apr 4 '17 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.