Debug a Kernel Module with QEMU + GDB Remote

Topic Overview

QEMU + GDB Remote Debugging

QEMU includes a built-in GDB stub that allows remote debugging of operating systems and kernel code without physical hardware. Kernel developers and security researchers use this workflow daily.

Setting Up Remote Debugging

Start QEMU with the GDB stub:

• -s: Shorthand for -gdb tcp::1234
• -S: Pause CPU at startup until GDB connects

Connect from GDB:

cCopy
Loading…

Once connected, you can examine registers with info registers, step through boot code with stepi, and inspect memory at known addresses with x/10x 0x100000.

For This Exercise

You will document the QEMU + GDB remote debugging workflow for kernel development. This exercise asks you to explain how to set breakpoints in kernel code and load module symbols, skills you will need when analyzing OS behavior or developing kernel modules.

Kernel Module Symbols

After the guest boots, load a module with insmod and find its base address in /proc/modules. In GDB, use add-symbol-file module.ko 0xaddress to load debug symbols at the correct relocation. Without this step, breakpoints in module code miss because GDB only knows the kernel's main symbol table. QEMU's stub exposes the full guest register set as if you were debugging bare metal.

Write a C program that implements the framing layer of the GDB Remote Serial Protocol used by QEMU's GDB stub.

Requirements:

• Encode: for each of M data strings, print the framed packet "$DATA#XX" where XX is the checksum: the sum of every character's ASCII value modulo 256, printed as two lowercase hex digits (use %02x, masking with 0xFF)
• Validate: for each of R packets of the form "$DATA#XX" (DATA never contains '$' or '#'), recompute the checksum over the characters between '$' and the '#' and compare with the two hex digits that follow
• For invalid packets print "packet N: BAD expected=XX" with the recomputed checksum; well-formed packets with a matching checksum print "packet N: OK"; malformed frames (no '$' prefix, no '#', or fewer than two checksum digits) print "packet N: INVALID"
• Output the M encoded packets first (in order), then the R validation results (1-based packet numbering)