Skip to content
/ kdress Public
forked from elfmaster/kdress

Transform vmlinuz into a fully debuggable vmlinux that can be used with /proc/kcore

Notifications You must be signed in to change notification settings

tin-z/kdress

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 

Repository files navigation

kdress

Transform vmlinuz into a fully debuggable vmlinux that can be used with /proc/kcore

Use cases

This tools makes it possible to use /proc/kcore for debugging or forensics analysis without having to recompile your kernel with symbols, or download a special debug kernel image. This software is actually from a much larger project called 'Kernel Voodoo' which is still private. Kernel Voodoo uses 'kdress' to create a vmlinux that can be used as a way to easily navigate kernel memory by symbol and also have a valid signature to compare code against from /proc/kcore.

Example

ryan@elfmaster:~/kdress$ make && sudo bash ./kdress.sh /boot/vmlinuz-`uname -r` vmlinux /boot/System.map-`uname -r`

[+] vmlinux has been successfully extracted
[+] vmlinux has been successfully instrumented with a complete ELF symbol table.

ryan@elfmaster:~/kdress$ sudo readelf -s vmlinux | grep sys_call_table
 33268: ffffffff81801400  4368 OBJECT  GLOBAL DEFAULT    4 sys_call_table
 33421: ffffffff81809ca0  2928 OBJECT  GLOBAL DEFAULT    4 ia32_sys_call_table

About

Transform vmlinuz into a fully debuggable vmlinux that can be used with /proc/kcore

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C 94.7%
  • Shell 3.6%
  • Makefile 1.7%