The header is self explanatory but to explain my self better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the init function. Can i find this info using "readelf" ?
Thanks,
The header is self explanatory but to explain my self better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the init function. Can i find this info using "readelf" ?
Thanks,
To read with readelf the parameter is "-s":
Options are:
-a --all Equivalent to: -h -l -S -s -r -d -V -A -I
-h --file-header Display the ELF file header
-l --program-headers Display the program headers
--segments An alias for --program-headers
-S --section-headers Display the sections' header
--sections An alias for --section-headers
-g --section-groups Display the section groups
-t --section-details Display the section details
-e --headers Equivalent to: -h -l -S
-s --syms Display the symbol table
--symbols An alias for --syms
--dyn-syms Display the dynamic symbol table
-n --notes Display the core notes (if present)
So, with readelf -s module.ko is enough to read the symbols.
First disassemble your module
objdump -xDsl module.ko > disassemble.txt
Then edit the file and search for section init. It look like this:
Disassembly of section .init.text:
002bdb01 : init_fct():
init_module()
function was located at the start of the module address... Have you examples where it is not the case? I am interested to know about! – perror Aug 27 '17 at 14:25