diff --git a/docs/commands/ksymaddr.md b/docs/commands/ksymaddr.md new file mode 100644 index 0000000..ba7f0cc --- /dev/null +++ b/docs/commands/ksymaddr.md @@ -0,0 +1,24 @@ +## Command `ksymaddr` + +`ksymaddr` helps locate a kernel symbol by its name. + +The syntax is straight forward: + +```text +ksymaddr +``` + +For example, + +```text +gef➤ ksymaddr commit_creds +[+] Found matching symbol for 'commit_creds' at 0xffffffff8f495740 (type=T) +[*] Found partial match for 'commit_creds' at 0xffffffff8f495740 (type=T): commit_creds +[*] Found partial match for 'commit_creds' at 0xffffffff8fc71ee0 (type=R): __ksymtab_commit_creds +[*] Found partial match for 'commit_creds' at 0xffffffff8fc8d008 (type=r): __kcrctab_commit_creds +[*] Found partial match for 'commit_creds' at 0xffffffff8fc9bfcd (type=r): __kstrtab_commit_creds +``` + +Note that the debugging process needs to have the correct permissions for this command to show +kernel addresses. For more information see also [this stackoverflow +post](https://stackoverflow.com/a/55592796). diff --git a/mkdocs.yml b/mkdocs.yml index 6343999..c57150e 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -22,6 +22,7 @@ nav: - ftrace: commands/ftrace.md - ida-rpyc: commands/ida-rpyc.md - is-syscall: commands/is-syscall.md + - ksymaddr: commands/ksymaddr.md - peekpointers: commands/peekpointers.md - retdec: commands/retdec.md - ropper: commands/ropper.md