# Linux Kernel Module Cheat

### 3.2. GDB step debug kernel post-boot

Let’s observe the kernel `write` system call as it reacts to some userland actions.

Start QEMU with just:

    ./run

and after boot inside a shell run:

    ./count.sh

which counts to infinity to stdout. Source: rootfs_overlay/lkmc/count.sh.

Then in another shell, run:

    ./run-gdb

and then hit:

    Ctrl-C
    break __x64_sys_write
    continue
    continue
    continue

And you now control the counting on the first shell from GDB!

Before v4.17, the symbol name was just `sys_write`, the change happened at d5a00528b58cdb2c71206e18bd021e34c4eab878. As of Linux v 4.19, the function is called `sys_write` in `arm`, and `__arm64_sys_write` in `aarch64`. One good way to find it if the name changes again is to try:

    rbreak .*sys_write

or just have a quick look at the sources!

When you hit `Ctrl-C`, if we happen to be inside kernel code at that point, which is very likely if there are no heavy background tasks waiting, and we are just waiting on a `sleep` type system call of the command prompt, we can already see the source for the random place inside the kernel where we stopped.