Codestin Search App

jxuanli · 2025-08-20T00:29:36Z

supporting kmod without provided typeinfo
supporting kmod for all kernel versions >= 5.0
supporting loading module symbol files (without needing to specify base address)
including kernel module symbols in kallsyms (klookup)

demo

…ov-2

disconnect3d · 2025-08-20T12:11:15Z

pwndbg/aglib/kernel/__init__.py

+
+def modules() -> pwndbg.dbg_mod.Value:
+    if arch_symbols() is not None:
+        return arch_symbols().modules()


Can we do this?:

if syms := arch_symbols() is not None: return syms.modules()

I believe it is cached so would be the same

Sure but it's still Python which cannot into nice optimisations (hopefully yet?)

Not like it matters a lot in this case but still :)

Copilot

Pull Request Overview

This PR improves the kmod command by supporting kernel module operations without requiring debug type information, expanding compatibility to all kernel versions >= 5.0, and adding functionality to load module symbol files automatically. The changes also integrate kernel module symbols into the kallsyms system for better symbol lookup.

Key changes:

Enhanced kmod command to work without debug type information by implementing fallback mechanisms
Added support for loading module symbol files with automatic base address detection
Integrated kernel module symbols into the kallsyms system for comprehensive symbol lookup

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
`pwndbg/commands/kmod.py`	Enhanced to support both typeinfo and non-typeinfo modes, added module loading functionality
`pwndbg/aglib/kernel/kmod.py`	New module providing kernel module parsing utilities without requiring debug symbols
`pwndbg/aglib/kernel/symbol.py`	Added `modules()` method and architecture-specific implementations for finding module lists
`pwndbg/aglib/kernel/kallsyms.py`	Integrated kernel module symbols into the kallsyms system
`pwndbg/dbg/__init__.py`	Added abstract `add_symbol_file` method to the debugger interface
`pwndbg/dbg/gdb/__init__.py`	Implemented GDB-specific `add_symbol_file` functionality
`pwndbg/commands/kbase.py`	Refactored to use the new debugger interface for adding symbol files
`tests/library/qemu_system/tests/test_commands_kernel.py`	Updated test to check for specific debug symbols instead of general debug info
`docs/commands/kernel/kmod.md`	Updated documentation to reflect new `-l/--load` option

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

pwndbg/aglib/kernel/kmod.py

pwndbg/commands/kmod.py

pwndbg/aglib/kernel/kmod.py

disconnect3d · 2025-08-20T12:12:26Z

pwndbg/aglib/kernel/kallsyms.py

        self.kernel_addresses = self.get_kernel_addresses()
        self.parse_symbol_table()
+        for sym_name, sym_addr, sym_type in pwndbg.aglib.kernel.kmod.all_modules_kallsyms():
+            self.kallsyms[sym_name] = (sym_addr, sym_type)


Can we do it like this?:

self.kallsyms = { sym_name: (sym_addr, sym_type) for sym_name, sym_addr, sym_type in pwndbg.aglib.kernel.kmod.all_modules_kallsyms() }

self.kallsyms is likely not empty by this point

disconnect3d · 2025-08-20T12:16:13Z

pwndbg/aglib/kernel/kmod.py

+        return ()
+    modules = int(modules)
+    result = []
+    cur = pwndbg.aglib.memory.read_pointer_width(int(modules))


modules is already an int

disconnect3d · 2025-08-20T12:16:17Z

pwndbg/aglib/kernel/kmod.py

+        print(M.warn("Cound not find modules"))
+        return None
+    module = pwndbg.aglib.memory.read_pointer_width(int(modules))
+    for i in range(0x100):


Why 0x100? is this arbitrary? can we add a comment saying why this number?

it is arbitrary

disconnect3d · 2025-08-20T15:21:01Z

pwndbg/aglib/kernel/kmod.py

+                    found = False
+                    break
+                size_offset = pwndbg.aglib.arch.ptrsize
+                if pwndbg.aglib.kernel.krelease() >= (6, 13):


Any link to source why?

disconnect3d · 2025-08-20T15:22:34Z

pwndbg/aglib/kernel/symbol.py

+        m = pattern.search(disass)
+        if m is None:
+            return None
+        return sum([int(m.group(i), 16) for i in [2, 3, 4]])


Suggested change

return sum([int(m.group(i), 16) for i in [2, 3, 4]])

return sum(int(m.group(i), 16) for i in [2, 3, 4])

disconnect3d · 2025-08-20T15:25:08Z

pwndbg/aglib/kernel/kmod.py

+        if pwndbg.aglib.memory.peek(symtab) is None:
+            continue
+        num_symtab = pwndbg.aglib.memory.read_pointer_width(
+            kallsyms + pwndbg.aglib.arch.ptrsize * 1


Suggested change

kallsyms + pwndbg.aglib.arch.ptrsize * 1

kallsyms + pwndbg.aglib.arch.ptrsize

disconnect3d · 2025-08-20T15:26:46Z

pwndbg/aglib/kernel/kmod.py

+            min_size + 0x38,
+        ):
+            found = True
+            for mem_type in range(mod_mem_type.MOD_MEM_NUM_TYPES.value - 1):


The -1 is here because MOD_MEM_NUM_TYPES is just number of all items and we want to skip it, is that right?

we actually need to skip MOD_RO_AFTER_INIT because the entry might be empty

jxuanli · 2025-08-20T16:21:15Z

@disconnect3d could you check again

…ov-2

jxuanli added 11 commits July 19, 2025 23:23

-

332a6ac

improving kmod

9f9552b

Merge branch 'dev' of https://github.com/pwndbg/pwndbg into kmod-improv

c04f528

bug fix

90df139

added helpers for finding offsets

edb2e36

improved helpers for determining offsets

aeb13c7

improving kmod helpers

56417e2

refactoring + handling kallsyms

5315e3d

Merge branch 'dev' of https://github.com/pwndbg/pwndbg into kmod-impr…

59affcb

…ov-2

recovering from stash

dbc70b0

doc + test

99f5aa4

jxuanli force-pushed the kmod-improv-2 branch from 436b95d to 99f5aa4 Compare August 20, 2025 01:14

disconnect3d requested a review from Copilot August 20, 2025 12:09

disconnect3d reviewed Aug 20, 2025

View reviewed changes

Copilot AI reviewed Aug 20, 2025

View reviewed changes

disconnect3d reviewed Aug 20, 2025

View reviewed changes

fixes based on coments

be707b6

Merge branch 'dev' of https://github.com/pwndbg/pwndbg into kmod-impr…

1c6f6a6

…ov-2

jxuanli force-pushed the kmod-improv-2 branch from 46b6f6a to 1c6f6a6 Compare August 20, 2025 16:54

improvements

2e17512

disconnect3d merged commit 41c8bc7 into pwndbg:dev Aug 22, 2025
24 checks passed

	return sum([int(m.group(i), 16) for i in [2, 3, 4]])
	return sum(int(m.group(i), 16) for i in [2, 3, 4])

	kallsyms + pwndbg.aglib.arch.ptrsize * 1
	kallsyms + pwndbg.aglib.arch.ptrsize

Uh oh!

Comments

Conversation

jxuanli commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

demo

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jxuanli commented Aug 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

jxuanli commented Aug 20, 2025 •

edited

Loading