The header is self explanatory but to explain myself better.
I have an ELF binary - loadable kernel module, compiled with symbols.
I want to know how to locate the offset of the module_init()
function.
Can I find this info using readelf
?
2 Answers
To read with readelf the parameter is "-s":
Options are:
-a --all Equivalent to: -h -l -S -s -r -d -V -A -I
-h --file-header Display the ELF file header
-l --program-headers Display the program headers
--segments An alias for --program-headers
-S --section-headers Display the sections' header
--sections An alias for --section-headers
-g --section-groups Display the section groups
-t --section-details Display the section details
-e --headers Equivalent to: -h -l -S
-s --syms Display the symbol table
--symbols An alias for --syms
--dyn-syms Display the dynamic symbol table
-n --notes Display the core notes (if present)
So, with readelf -s module.ko is enough to read the symbols.
First disassemble your module
objdump -xDsl module.ko > disassemble.txt
Then edit the file and search for section init. It look like this:
Disassembly of section .init.text
:
002bdb01 <init_module>:
init_fct():
-
1This answer looks like it has great potential for improvement. @laurent can I suggest you edit it to elaborate a bit more?– NirIzrApr 4, 2017 at 15:22
init_module()
function was located at the start of the module address... Have you examples where it is not the case? I am interested to know about!