3

TLTR

I want to load linux kernel headers vs. 4.19 to Ghidra so it recognizes kernel structures and function signatures.

Full description

I'm trying to reverse engineer a linux kernel module (kernel version 4.19). Ghidra does recognize correctly all function names such as: open, misc_register etc, but it cannot determinate their exact signatures.

Let's take as an example function copy_from_user with signature:

unsigned long copy_from_user (void *to, const void __user *from, unsigned long n);

and here's how Ghidra sees it:

undefined _copy_from_user (void)

I believe that it won't be the last kernel module for me to reverse engineer and so I would like to learn how to load all missing kernel structures to the program.

Moreover I am aware that I can edit the function signature by hand, but I would then need to add plenty of structures by hand as well (such as struct file) and this would be very ineffective.

What I've tried so far

(I'm super new to Ghidra and if you know better way to load linux kernel headers, please just share.)

I've downloaded headers from debian repository:

$ wget linux-headers-4.19.0-6-common_4.19.67-2+deb10u2_all.deb .
$ ls
linux-headers-4.19.0-6-common_4.19.67-2+deb10u2_all.deb  usr
$ ls /usr/src/
linux-headers-4.19.0-6-common

I extracted and I've copied the whole content of all files into all_headers.h (Ghidra didn't want to accept the directory itself. I couldn't find any information about loading files form Makefile as well)

$ cat `find . | grep .h` > all_headers.h
$ cat all_headers.h | wc -c
29824650

And I've provided all_headers.h to get parsed but Ghidra has only added around 20 defines and no function signatures.

enter image description here

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.