I would like to debug a loaded kernel module I don't have the source code to; I suspect it's a virus. Is there a way to feed it into GDB for analysis?
How to debug an inserted kernel module?
kernel;debugging;kernel modules
From a debugging perspective, the kernel is a special process, distinct from the user space processes, which communicate with the kernel via a sort of rpc mechanism (syscalls) or mapped memory..  I don't think you can see the kernel's data structure simply by inspecting some random user process.Another problem is, that every user space process (including the debugger) needs the kernel to run and to communicate with the users; I don't think you can just stop the kernel and believe that the debugger will continue to run.   So you need to run GDB on a second machine, and that is what is called Kernel debugging.Please refer to (http://kgdb.linsyssoft.com/, Documentation/sh/kgdb) for more details.