Kernel hacking goodies
The Linux kernel is a vast topic with regards to forensic analysis and reverse engineering. There are many exciting ways to go about instrumenting the kernel for purposes of hacking, reversing, and debugging, and Linux offers its users many entry points into these areas. I have discussed some files and APIs that are useful throughout this chapter, but I will also give a small, condensed list of things that may be of help in your research.
General reverse engineering and debugging
/proc/kcore/proc/kallsyms/boot/System.map/dev/mem(deprecated)/dev/kmem(deprecated)- GNU debugger (used with kcore)
Advanced kernel hacking/debugging interfaces
- Kprobes
- Ftrace
Papers mentioned in this chapter
- Kprobe instrumentation: http://phrack.org/issues/67/6.html ...
Get Learning Linux Binary Analysis now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
