linux核心模組調試

1. 開啟虛擬機器，虛擬機器運行到 kgdb: Waiting for connection from remote gdb

2. 在Host機上運行： socat tcp-listen:8888 /tmp/vbox2, 其中/tmp/vbox2為管道檔案,它是目標機串口的重新導向目的檔案，socat將這個管道檔案又重新導向到tcp socket的8888連接埠。

3. 開啟一個新的虛擬終端，cd path/to/kernel/source/tree, 然後執行gdb ./vmlinux

輸出

GNU gdb 6.8-debian

Copyright (C) 2008 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.  Type "show copying"

and "show warranty" for details.

This GDB was configured as "i486-linux-gnu"...

(gdb) set-remote

set remote baud rate to 115200c/s

set remote target to local tcp socket

kgdb_breakpoint () at kernel/kgdb.c:1721

1721        wmb(); /* Sync point after breakpoint */

(gdb) c

Continuing.

目標機會一直啟動，直到提示輸入使用者名稱密碼。

4. 進入目標機，輸入使用者名稱密碼(推薦使用字元介面下的root使用者)，輸入g命令，目標機被斷下，控制移交到Host機中的gdb中。(目標機root的使用者目錄中的.bashrc中添加一行alias g='echo g>/proc/sysrq-trigger')

5. 在Host機中的gdb中

(gdb) set-mod-break

set breakpoint in system module init function

Breakpoint 1 at 0xc014bac5: file kernel/module.c, line 2288.

(gdb) c

Continuing.

6. 在目標機中

insmod klogger2.ko

目標機再次斷下，控制權移交Host機中的gdb

7. 在Host機中的gdb中

[New Thread 4693]

[Switching to Thread 4693]

Breakpoint 1, sys_init_module (umod=0x0, len=0, uargs=0x0)

at kernel/module.c:2288

2288        if (mod->init != NULL)

(gdb) print-mod-segment

Name:.note.gnu.build-id Address:0xdf977058

Name:.text Address:0xdf975000

Name:.rodata Address:0xdf977080

Name:.rodata.str1.4 Address:0xdf9774b4

Name:.rodata.str1.1 Address:0xdf977522

Name:.parainstructions Address:0xdf977a00

Name:.data Address:0xdf978440

Name:.gnu.linkonce.this_module Address:0xdf978480

Name:.bss Address:0xdf978a00

Name:.symtab Address:0xdf977a08

Name:.strtab Address:0xdf978078

(gdb) add-symbol-file /home/done/programs/linux-kernel/vlogger/klogger2.ko 0xdf975000 -s .data 0xdf978440 -s .bss 0xdf978a00

add symbol table from file "/home/done/programs/linux-kernel/vlogger/klogger2.ko" at

.text_addr = 0xdf975000

.data_addr = 0xdf978440

.bss_addr = 0xdf978a00

(y or n) y

Reading symbols from /home/done/programs/linux-kernel/vlogger/klogger2.ko...done.

(gdb) b hook_init

Breakpoint 2 at 0xdf976d19: file /home/done/programs/linux-kernel/vlogger/hook.c, line 255.

(gdb)

你可以調試自己些的LKM模組了

附gdb的初始化設定檔~/.gdbinit

define set-remote

echo set remote baud rate to 115200c/s\n

set remotebaud 115200

echo set remote target to local tcp socket\n

target remote tcp:localhost:8888

end

define set-mod-break

echo set breakpoint in system module init function\n

break kernel/module.c:2288

end

define print-mod-segment

set $sect_num=mod->sect_attrs->nsections

set $cur=0

while $cur < $sect_num

printf "Name:%-s Address:0x%x\n",mod->sect_attrs->attrs[$cur]->name,mod->sect_attrs->attrs[$cur]->address

set $cur=$cur+1

end

end

後記：gdb的調試指令碼真難寫，簡單的字串變數串連和等價判斷都顯得十分困難，不知道是我水平太差還是gdb的指令碼功能太弱，總之比起Windbg來說，核心調試困難程度上了個等級。