1

I'm writing a kernel module which involves the tasklist_lock, __bss_start.

These symbols are not exported. I'm pretty sure even if not exported, we can access the symbols from text sections using kernsym_lookup_name()

Reference How my custom module on linux 3.2.28 can make a call to print_cpu_info? 

$ vim System.map
...
80017be0 T register_undef_hook
80017c28 T unregister_undef_hook
80017c70 T do_unexp_fiq
...
806eb000 D mmlist_lock
806eb040 D tasklist_lock
806eb080 d softirq_vec
....

T represents text symbol.
D and d represents data segment symbol.

I'm able to access register_undef_hook() and unregister_undef_hook() using kallsyms_lookup_name().

But not tasklist_lock.

Please share your knowledge to access tasklist_lock from kernel module(LKM).

Community
  • 1
  • 1
Jeyaram
  • 9,158
  • 7
  • 41
  • 63

1 Answers1

1

See this noble post

#include <linux/module.h>
#include <linux/kallsyms.h>
#include <linux/string.h>

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Access non-exported symbols");
MODULE_AUTHOR("Stephen Zhang");

static int __init lkm_init(void)
{
    char *sym_name = "__bss_start";
    unsigned long sym_addr = kallsyms_lookup_name(sym_name);
    char filename[256];

    strncpy(filename, (char *)sym_addr, 255);

    printk(KERN_INFO "[%s] %s (0x%lx): %s\n", __this_module.name, sym_name, sym_addr, filename);

    return 0;
}

static void __exit lkm_exit(void)
{
}

module_init(lkm_init);
module_exit(lkm_exit);
0x90
  • 39,472
  • 36
  • 165
  • 245
  • I tried this already. This works for symbols of type `T` but not for the type `D`. – Jeyaram Feb 10 '14 at 09:35
  • 1
    So you will have to use hard coded address for that... or export it from the kernel, apparently you have bad design see here... or you are trying to do rootkit http://stackoverflow.com/questions/2103315/linux-kernel-system-call-hooking-example – 0x90 Feb 10 '14 at 09:53
  • I cannot modify kernel side. But hard coding address will fix my current situation, but not the permanent solution. Anyway thanks for your efforts. – Jeyaram Feb 10 '14 at 09:58
  • If it is for debug use kprobes and jprobes. Sometimes there are in the .config flags reflect the .bss and .text offset – 0x90 Feb 10 '14 at 09:58
  • Not for debugging purpose :) – Jeyaram Feb 10 '14 at 09:59