How to parse the current Linux kernel?

Question

Looking for a way to parse a running kernel. Can I do this via / dev / kmem? I am running linux 2.6.32. Or I can use the kernel module to start the kernel. I am new to this. Please, help.

All I want to do is check the kernel image for a malicious module by seeing if any specific instruction has occurred.

Answer 1

Try the Linux kernel debugger .

Refresh

As I said, try the Linux kernel debugger . Look in a related article for about half a page where it says:

, schedule. IDCOUNT:

[0]kdb> id schedule