Summary
In this chapter, we learned how to analyze kernel binaries. First, we discussed the approach to performing static analysis and highlighted the differences between static and dynamic analysis.
Then, we introduced typical kernel binaries, such as *.ko files and vmlinux, and explained how these files are organized using the ELF format. We also examined common patterns found in kernel binaries. For *.ko files, we looked at the metadata found in the .modinfo section.
We also explored assembly routines that can only be found in kernel binaries. When analyzing kernel binaries, you will see assembly routines that access system resources through various system registers. This pattern is not found in user-space binaries because the kernel runs at EL1, which has the privilege to control hardware resources.
Finally, we discussed the common patterns used to access fields within a struct, a data structure widely used in both kernel and user-space binaries to manage data.
...
