CODEWITHSUNDEEP
linuxobjdump
jaeyong
jaeyong

Reputation: 9363

disassembly Linux kernel using objdump

If I try to disassem Linux kernel, it takes quite long time due to the big size of Linux elf-binary.

Is there a way to only disassem a function or a symbol, for instance start_kernel function?

What I don't want is to use grep, since it anyway takes very long time.

Upvotes: 2

Views: 11674

Answers (3)

Benedict Schlüter
Benedict Schlüter

Reputation: 462

For disassembling a given function in the Linux kernel you can use the following objdump command.

objdump vmlinux --disassemble='add your function name here'

From the objdump documentation:

   --disassemble=symbol
       Display the assembler mnemonics for the machine instructions
       from the input file.  This option only disassembles those
       sections which are expected to contain instructions.  If the
       optional symbol argument is given, then display the assembler
       mnemonics starting at symbol.  If symbol is a function name
       then disassembly will stop at the end of the function,
       otherwise it will stop when the next symbol is encountered.
       If there are no matches for symbol then nothing will be
       displayed.

Upvotes: 2

Jagdish
Jagdish

Reputation: 1924

You can not disassemble particular function or symbol alone but instead of full kernel image, you can disassemble specific object file.

ex.

objdump -DS XYZ.o > XYZ.S

Upvotes: -1

user2845360
user2845360

Reputation:

Unless you have compiled kernel with debugging symbols included, there are no symbols for objdump to use. It is highly unlikely the kernel binary has debugging symbols included, unless you've specifically compiled it with such options.

In case your kernel binary does have debugging symbols, they can be found using nm -g and then further used with objdump -j <symbol>.

Upvotes: 1

Related Questions