CODEWITHSUNDEEP
linuxkernelsystem-calls
user2571676
user2571676

Reputation: 51

Get the end address of Linux kernel function on run-time

I am trying to get the boundary for a kernel function (system calls for example). Now, if I understand correctly, I can get the start address of the interested function by reading /proc/kallsyms or System.map but I dont know how to get the end address of this function.

As you may know, /proc/kallsyms allow us to view the symbol table for Linux kernel so we can see the start address of all exported symbols. Can we use the start address of the next function to calculate the end address of the previous function? If we cannot do like this, could you suggest me another ways?

Upvotes: 3

Views: 1001

Answers (1)

Cel Skeggs
Cel Skeggs

Reputation: 1877

Generally, executables store only the start address of a function, as it is all that is required to call the function. You will have to infer the end address, rather than simply looking it up.

You could try to find the start address of the subsequent function, but that wouldn't always work either. Imagine the following:

void func_a() {
    // do something
}

static void helper_function() {
    // do something else
}

void func_b() {
    // ...
    helper_function();
    // ...
}

You could get the address of func_a and func_b, but helper_function would not show up, because nothing needs to link to it. If you tried to use func_b as the end of func_a (assuming that the order in the compiled code in equivalent to the order in the source code, which is not guaranteed), you would end up accidentally including code that you didn't need to include - and might not find code that you need to find when inlining other functions into func_b.

So, how do we find this information? Well, if you think about it - the information does exist - all of the paths within func_a will eventually terminate (in a loop, return statement, tail call, etc), probably before helper_function begins.

You would need to parse out the code of func_a and build up a map of all of the possible code paths within it. Of course, you would need to do this anyway to inline other functions into it - so it shouldn't be too much harder to simply not care about the end address of the function.

One final note: in this example, you would have trouble finding helper_function in order to know to inline it, because the symbol wouldn't show up in kallsyms. The solution here is that you can track the call instructions in individual functions to determine what hidden functions exist that you didn't know about otherwise.

TL;DR: You can only find the end address by parsing the compiled code. You have to parse this anyway, so just do it once.

Upvotes: 1

Related Questions