get_kernel_syms - Linux


The get_kernel_syms command is a Linux utility used to extract kernel symbols and their corresponding addresses from the kernel address space. It is primarily used in debugging, kernel analysis, and custom kernel module development.


get_kernel_syms [options] <filename>


  • -a or --all: Dump all symbols, including non-exported ones.
  • -e or --export-only: Only dump exported symbols.
  • -m or --module: Only dump symbols for specified kernel modules.
  • -n or --numeric: Dump the symbols alongside their numeric addresses.
  • -s or --symbol: Search for specific symbols in the kernel symbol table.


Extract all symbols from the kernel:


Dump only exported symbols:

get_kernel_syms -e

Extract symbols for specific kernel modules:

get_kernel_syms -m mymodule1 mymodule2

Search for a specific symbol:

get_kernel_syms -s symbolname

Common Issues

  • Missing symbols: If a symbol is not found, it may not be exported or may not exist in the kernel.
  • "No such device or address" error: This can occur if the kernel image file specified is not valid or accessible.


get_kernel_syms can be combined with other tools like gdb for debugging, kallsyms for symbol table manipulation, and readelf for examining symbol information in executables.

Related Commands

  • kallsyms: Kernel symbol table manipulation tool.
  • readelf: Program file dumper.
  • gdb: GNU debugger.