linux内核安装指南-5

010:")取出16进制值，在内核名字列表中查看一下，看下那个内核名称列表中，
   究竟哪个内核函数包含这个被攻击的地址。
  

   To find out the kernel function name, you''ll need to find the system
   binary associated with the kernel that exhibited the symptom.  This is
   the file ''linux/vmlinux''.  To extract the namelist and match it against
   the EIP from the kernel crash, do:
  
   为了找出这个内核函数名，你需要找到可以展示这个症状的二进制系统所相关的内核。
   这个文件叫做"linux/vmlinux"。提取名称列表，和崩溃内核的EIP相匹配，这样做：  

        nm vmlinux | sort | less

   This will give you a list of kernel addresses sorted in ascending
   order, from which it is simple to find the function that contains the
   offending address.  Note that the address given by the kernel
   debugging messages will not necessarily match exactly with the
   function addresses (in fact, that is very unlikely), so you can''t
   just ''grep'' the list: the list will, however, give you the starting
   point of each kernel function, so by looking for the function that
   has a starting address lower than the one you are searching for but
   is followed by a function with a higher address you will find the one
   you want.  In fact, it may be a good idea to include a bit of
   "context" in your problem report, giving a few lines around the
   interesting one.
  
   这个命令将给你一个内核地址列表，升序排列，从这个列表中，很简单就可以找到包含
   被攻击地址的函数。注意：这个内核调试信息给出的地址对精确匹配这个函数地址并不
   是必须的，实际上，一点都不象，所以，你无法使用''grep''这个列表：然而，这个列表
   将给你每个内核函数的开始地址，所以，通过查找一个拥有开始地址小于目标地址，但
   是下个函数地址要高于目标地址的函数，你就可以找到你想要的。实际上，在你程序报
   告中，包含一些上下文信息是个好主意，提供一些感兴趣那个函数周边的行。

   If you for some reason cannot do the above (you have a pre-compiled
   kernel image or similar), telling me as much about your setup as
   possible will help.  Please read the REPORTING-BUGS document for details.

   如果你因为一下原因无法做上面的事情(你的内核映象是预编译的以及诸如此类)，
   告诉我尽可能多，有帮助的安装信息。请阅读REPORTING-BUGS文档了解细节。

 - Alternately, you can use gdb on a running kernel. (read-only; i.e. you
   cannot change values or set break points.) To do this, first compile the
   kernel with -g; edit arch/i386/Makefile appropriately, then do a "make
   clean". You''ll also need to enable CONFIG_PROC_FS (via "make config").
  
   另外，你可以在正在运行的内核上使用gdb.(只读；你无法改变值，或者设置断点。)
   为了实现这个目的，请先使用-g参数编译内核；正确编辑 arch/i386/Makefile，然后
   执行"make clean"。你也需要打开 CONFIG_PROC_FS选项(通过"make config")。

   After you''ve rebooted with the new kernel, do "gdb vmlinux /proc/kcore".
   You can now use all the usual gdb commands. The command to look up the
   point where your system crashed is "l *0xXXXXXXXX". (Replace the XXXes
   with the EIP value.)

   在你使用新内核重新启动后，执行"gdb vmlinux /proc/kcore"。现在，你就可以使用所有
   的gdb常用命令。查看你系统崩溃点的命令是"l *0xXXXXXXXX"。(用EIP值替换XXX...)。

   gdb''ing a non-running kernel currently fails because gdb (wrongly)
   disregards the starting offset for which the kernel is compiled.
  
   gdb一个非运行态的内核现在还不行，因为gdb错误地无视内核编译后地起始偏移量。

文章出处：DIY部落(http://www.diybl.com/course/6_system/linux/Linuxjs/20071215/92305_5.html)