Hello guy’s ! How can I accurately and deterministically find out the inputs of a kernel module?
The case is as follows:
There is a system running an unknown kmod, and I need to find out all its potential triggers. How can I do this?
3 Likes
Welcome to the community @fff, thanks for joining us! 
2 Likes
I am afraid that the question is a bit vague. Well, the obvious answer would be to find out the module’s documentation and/or source code.
Kernel module - ArchWiki suggests
To list the options that are set for a loaded module use systool(1) from sysfsutils:
Regarding kmod at Debian/Ubuntu
$ apt show kmod
Package: kmod
Version: 31+20240202-2ubuntu7.2
...
Description: tools for managing Linux kernel modules
This package contains a set of programs for loading, inserting, and
removing kernel modules for Linux.
...
Please note man pages for kmod tools below. Probably, modinfo command might be of some help.
$ dpkg -L kmod
/.
/etc
/etc/depmod.d
/etc/depmod.d/ubuntu.conf
/etc/init.d
/etc/init.d/kmod
/etc/modprobe.d
/etc/modprobe.d/blacklist-ath_pci.conf
/etc/modprobe.d/blacklist-firewire.conf
/etc/modprobe.d/blacklist-framebuffer.conf
/etc/modprobe.d/blacklist-rare-network.conf
/etc/modprobe.d/blacklist.conf
/etc/modprobe.d/disable-algif_aead.conf
/etc/modprobe.d/iwlwifi.conf
/usr
/usr/bin
/usr/bin/kmod
/usr/lib
/usr/lib/modprobe.d
/usr/lib/modprobe.d/aliases.conf
/usr/sbin
/usr/share
/usr/share/bash-completion
/usr/share/bash-completion/completions
/usr/share/bash-completion/completions/kmod
/usr/share/doc
/usr/share/doc/libkmod2
/usr/share/doc/libkmod2/README.md
/usr/share/doc/libkmod2/TODO
/usr/share/initramfs-tools
/usr/share/initramfs-tools/hooks
/usr/share/initramfs-tools/hooks/kmod
/usr/share/man
/usr/share/man/man5
/usr/share/man/man5/depmod.d.5.gz
/usr/share/man/man5/modprobe.d.5.gz
/usr/share/man/man5/modules.dep.5.gz
/usr/share/man/man8
/usr/share/man/man8/depmod.8.gz
/usr/share/man/man8/insmod.8.gz
/usr/share/man/man8/kmod.8.gz
/usr/share/man/man8/lsmod.8.gz
/usr/share/man/man8/modinfo.8.gz
/usr/share/man/man8/modprobe.8.gz
/usr/share/man/man8/rmmod.8.gz
/usr/bin/lsmod
/usr/sbin/depmod
/usr/sbin/insmod
/usr/sbin/lsmod
/usr/sbin/modinfo
/usr/sbin/modprobe
/usr/sbin/rmmod
/usr/share/doc/kmod
/usr/share/man/man5/modules.dep.bin.5.gz
/etc/modprobe.d/blacklist-watchdog.conf
5 Likes
Welcome to the Community @fff
There is no static “input” to a kernel module.
Module loading is event-driven via request_module(), triggered by kernel subsystems (device probing, udev, filesystem, networking, etc.).
To deterministically identify the trigger, you must use runtime tracing:
- kmod/module tracepoints for event capture
- function_graph tracer for call-chain reconstruction
- or kprobes on request_module() for full stack inspection
Without tracing enabled at runtime, the kernel does not retain enough provenance information to reconstruct the origin of the module load event.
5 Likes
Welcome to the forum @fff!
2 Likes
Thanks ! I use next method:
The goal is not to guess the entrypoint by module name, but to prove the chain:
userspace syscall -> kernel object -> registered callback -> function inside the target module
MOD=nf_conntrackmodinfo "$MOD"modinfo -n "$MOD"grep "\[$MOD\]" /proc/kallsyms > /tmp/${MOD}.kallsyms
Goal: collect the module file and the list of functions that definitely belong to this module.
Set kprobes or ftrace on registration APIs:
cdev_add
misc_register
proc_create*
debugfs_create_file
register_sysctl
driver_register
i2c_register_driver
pci_register_driver
usb_register_driver
nf_register_net_hooks
nfnetlink_subsys_register
genl_register_family
register_filesystem
crypto_register_*
Then reload the module under tracing:
modprobe -r “$MOD”
start tracing
modprobe “$MOD”
stop tracing
Goal: identify what the module registered.
4 Likes
Interesting topic. I’ve not used kmod tracing, but this is good stuff! Thanks for all who contributed to this topic!
3 Likes