# How to get kernel function addresses



## zeroth (Oct 28, 2011)

Hi everyone, 

1- I need to discover which function is hooked by rootkits or etc. and I think I can do it via matching original kernel function addr and pointer. So I need to get original kernel function addr and "redirected address".

2- it's about /dev/ksyms. Is it only found in custom compiled kernel?

Thank you.


----------



## zeroth (Oct 30, 2011)

1 - If someone is looking for a solution to determine which function is hooked by rootkits (just like me). You can do this by calculating the correct function address. For example;


```
original_addr = kernsys_num + sysent_value * sizeof(struct sysent);
```

if the previous addresses is different from current addresses.  it's hooked!

2- I don't know


----------

