# Linux Kernel Module Cheat

### 3.4. GDB step debug kernel module

https://stackoverflow.com/questions/28607538/how-to-debug-linux-kernel-modules-with-qemu/44095831#44095831

Loadable kernel modules are a bit trickier since the kernel can place them at different memory locations depending on load order.

So we cannot set the breakpoints before `insmod`.

However, the Linux kernel GDB scripts offer the `lx-symbols` command, which takes care of that beautifully for us.

Shell 1:

    ./run

Wait for the boot to end and run:

    insmod timer.ko

Source: kernel_modules/timer.c.

This prints a message to dmesg every second.

Shell 2:

    ./run-gdb

In GDB, hit `Ctrl-C`, and note how it says:

    scanning for modules in /root/linux-kernel-module-cheat/out/kernel_modules/x86_64/kernel_modules
    loading @0xffffffffc0000000: /root/linux-kernel-module-cheat/out/kernel_modules/x86_64/kernel_modules/timer.ko

That’s `lx-symbols` working! Now simply:

    break lkmc_timer_callback
    continue
    continue
    continue

and we now control the callback from GDB!

Just don’t forget to remove your breakpoints after `rmmod`, or they will point to stale memory locations.

TODO: why does `break work_func` for `insmod kthread.ko` not very well? Sometimes it breaks but not others.

- GDB step debug kernel module insmodded by init on ARM

- GDB module_init

- Bypass lx-symbols