# Linux Kernel Module Cheat

#### 17.5.4. vermagic

kernel_modules/vermagic.c

As of kernel v5.8, you can’t use `VERMAGIC_STRING` string from modules anymore as per: https://github.com/cirosantilli/linux/commit/51161bfc66a68d21f13d15a689b3ea7980457790. So instead we just showcase `init_utsname`.

Sample insmod output as of LKMC fa8c2ee521ea83a74a2300e7a3be9f9ab86e2cb6 + 1 aarch64:

    <6>[   25.180697] sysname    = Linux
    <6>[   25.180697] nodename   = buildroot
    <6>[   25.180697] release    = 5.9.2
    <6>[   25.180697] version    = #1 SMP Thu Jan 1 00:00:00 UTC 1970
    <6>[   25.180697] machine    = aarch64
    <6>[   25.180697] domainname = (none)

Vermagic is a magic string present in the kernel and previously visible in MODULE_INFO on kernel modules. It is used to verify that the kernel module was compiled against a compatible kernel version and relevant configuration:

    insmod vermagic.ko

Possible dmesg output:

    VERMAGIC_STRING = 4.17.0 SMP mod_unload modversions

If we artificially create a mismatch with `MODULE_INFO(vermagic`, the insmod fails with:

    insmod: can't insert 'vermagic_fail.ko': invalid module format

and `dmesg` says the expected and found vermagic found:

    vermagic_fail: version magic 'asdfqwer' should be '4.17.0 SMP mod_unload modversions '

Source: kernel_modules/vermagic_fail.c

The kernel’s vermagic is defined based on compile time configurations at include/linux/vermagic.h:

    #define VERMAGIC_STRING                                                 \
            UTS_RELEASE " "                                                 \
            MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT                     \
            MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS       \
            MODULE_ARCH_VERMAGIC                                            \
            MODULE_RANDSTRUCT_PLUGIN

The `SMP` part of the string for example is defined on the same file based on the value of `CONFIG_SMP`:

    #ifdef CONFIG_SMP
    #define MODULE_VERMAGIC_SMP "SMP "
    #else
    #define MODULE_VERMAGIC_SMP ""

TODO how to get the vermagic from running kernel from userland? https://lists.kernelnewbies.org/pipermail/kernelnewbies/2012-October/006306.html

kmod modprobe has a flag to skip the vermagic check:

    --force-modversion

This option just strips `modversion` information from the module before loading, so it is not a kernel feature.