10

TLTR

I want to load Linux kernel headers vs. 4.19 to Ghidra so that it recognizes kernel structures and function signatures.

Full description

I'm trying to reverse engineer a Linux kernel module (kernel version 4.19). Ghidra does recognize correctly all function names such as: open, misc_register, etc., but it cannot determine their exact signatures.

Let's take as an example the copy_from_user() function with the signature:

unsigned long copy_from_user (void *to, const void __user *from, unsigned long n);

and here's how Ghidra sees it:

undefined _copy_from_user (void)

I believe that it won't be the last kernel module for me to reverse engineer, and so I would like to learn how to load all missing kernel structures to the program.

Moreover, I am aware that I can edit the function signature by hand, but I would then need to add plenty of structures by hand as well (such as struct file) and this would be very ineffective.

What I've tried so far

(I'm super new to Ghidra and if you know a better way to load Linux kernel headers, please just share.)

I've downloaded headers from Debian repository:

$ wget linux-headers-4.19.0-6-common_4.19.67-2+deb10u2_all.deb .
$ ls
linux-headers-4.19.0-6-common_4.19.67-2+deb10u2_all.deb  usr
$ ls /usr/src/
linux-headers-4.19.0-6-common

I extracted and copied the whole content of all files into all_headers.h (Ghidra didn't want to accept the directory itself. I couldn't find any information about loading files form Makefile as well)

$ cat `find . | grep .h` > all_headers.h
$ cat all_headers.h | wc -c
29824650

And I've provided all_headers.h to get parsed, but Ghidra has only added around 20 defines and no function signatures.

enter image description here

enter image description here

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.