2

The header is self explanatory but to explain myself better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the module_init() function.
Can I find this info using readelf ?

2
  • 2
    For example, lwn.net/Articles/531148 Also, module_init is not a real function, it's a macro as described in that article. Jul 14, 2016 at 9:36
  • 1
    @TakashiYamamoto: Tell me if I am wrong, but I always thought that the init_module() function was located at the start of the module address... Have you examples where it is not the case? I am interested to know about!
    – perror
    Aug 27, 2017 at 14:25

2 Answers 2

2

To read with readelf the parameter is "-s":

 Options are:
    -a --all               Equivalent to: -h -l -S -s -r -d -V -A -I
    -h --file-header       Display the ELF file header
    -l --program-headers   Display the program headers
        --segments          An alias for --program-headers
    -S --section-headers   Display the sections' header
       --sections          An alias for --section-headers
    -g --section-groups    Display the section groups
    -t --section-details   Display the section details
    -e --headers           Equivalent to: -h -l -S
    -s --syms              Display the symbol table
       --symbols           An alias for --syms
    --dyn-syms             Display the dynamic symbol table
    -n --notes             Display the core notes (if present)

So, with readelf -s module.ko is enough to read the symbols.

-3

First disassemble your module

objdump -xDsl module.ko > disassemble.txt

Then edit the file and search for section init. It look like this:

Disassembly of section .init.text:

002bdb01 <init_module>:
init_fct():
1
  • 1
    This answer looks like it has great potential for improvement. @laurent can I suggest you edit it to elaborate a bit more?
    – NirIzr
    Apr 4, 2017 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.