Home/ Questions/Q 6060413
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T08:49:22+00:00

The following code is mentioned in this question . int (*my_printk)(const char *fmt, …);

  • 0

The following code is mentioned in this question.

int (*my_printk)(const char *fmt, ...);
my_printk = find_symbol_address("printk");
(*my_printk)("Hello, world!\n");

How does the OP find the symbol address if the LSM framework doesn’t export its symbols? The OP’s question is in kernel mode; I am curious how to do it in user mode.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Your linked-to question is very different than userspace: because the kernel maintains a complete symbol table (see kernel/module.c function lookup_symbol), it isn’t very difficult to scan the table and look for a specific symbol, find its address, and perform the fairly hacky interpositioning he is performing. (I understand his reasoning, but its a pity he didn’t just make his source a patch that could be applied to distribution kernels or even included into the mainline kernel tree. Fair enough, his code, his time, his playground, but it does mean he gets to do some pretty hacky things.)

    User mode is a little different; if the symbols aren’t available, they’re just not available. The kernel developers went to some effort to emulate the case of “having symbols available” that is common in userspace, and if you’ve strip(1)ed your code, they’re gone.

    • 0