get_kernel_syms - Linux

Overview

The get_kernel_syms command is a Linux utility used to extract kernel symbols and their corresponding addresses from the kernel address space. It is primarily used in debugging, kernel analysis, and custom kernel module development.

Syntax

get_kernel_syms [options] <filename>

Options/Flags

  • -a or --all: Dump all symbols, including non-exported ones.
  • -e or --export-only: Only dump exported symbols.
  • -m or --module: Only dump symbols for specified kernel modules.
  • -n or --numeric: Dump the symbols alongside their numeric addresses.
  • -s or --symbol: Search for specific symbols in the kernel symbol table.

Examples

Extract all symbols from the kernel:

get_kernel_syms

Dump only exported symbols:

get_kernel_syms -e

Extract symbols for specific kernel modules:

get_kernel_syms -m mymodule1 mymodule2

Search for a specific symbol:

get_kernel_syms -s symbolname

Common Issues

  • Missing symbols: If a symbol is not found, it may not be exported or may not exist in the kernel.
  • "No such device or address" error: This can occur if the kernel image file specified is not valid or accessible.

Integration

get_kernel_syms can be combined with other tools like gdb for debugging, kallsyms for symbol table manipulation, and readelf for examining symbol information in executables.

Related Commands

  • kallsyms: Kernel symbol table manipulation tool.
  • readelf: Program file dumper.
  • gdb: GNU debugger.