KVM_NLIST(3)

okay bestie, welcome to the KVM_NLIST(3) page from the Library Functions Manual 💖 — we’re retrieving symbol table names from a kernel image and it’s lowkey iconic.

✨ NAME ✨

kvm_nlist, kvm_nlist2 — retrieve symbol table names from a kernel image. that’s the whole vibe.

📚 LIBRARY 📚

Kernel Data Access Library (libkvm, -lkvm) — link it with -lkvm, bestie.

🌸 SYNOPSIS 🌸

#include <kvm.h>
#include <nlist.h>

int
kvm_nlist(kvm_t *kd, struct nlist *nl);

int
kvm_nlist2(kvm_t *kd, struct kvm_nlist *nl);

💖 DESCRIPTION 💖

kvm_nlist() retrieves the symbol table entries indicated by the name list argument nl. That argument points to an array of nlist structures, and the array is terminated by an entry whose n_name field is NULL (see nlist(3)). Each symbol gets looked up using the n_name field, and if it’s found, the corresponding n_type and n_value fields are filled in. If the symbol is not found, those fields are set to 0 — no cap.

The kldsym(2) system call is used to locate symbols in live kernels. This is a less than perfect emulation of the nlist values, but it has the advantage of being aware of kernel modules and is reasonably fast. honestly? slay.

kvm_nlist2() retrieves the symbol table entries indicated by the name list argument nl. This nl points to an array of struct kvm_nlist structures, terminated by an entry whose n_name field is NULL. These structures are similar to the nlist structures used by kvm_nlist(), except that the n_value field uses a different type (kvaddr_t) to avoid truncation when examining non-native kernel images. it’s giving cross-platform awareness 💅

🎀 RETURN VALUES 🎀

kvm_nlist() and kvm_nlist2() return the number of invalid entries found. If the kernel symbol table was unreadable, -1 is returned. that’s your vibe check.

🔗 SEE ALSO 🔗

go look at these besties:

• kldsym(2)
• kvm(3)
• kvm_close(3)
• kvm_getargv(3)
• kvm_getenvv(3)
• kvm_geterr(3)
• kvm_getprocs(3)
• kvm_native(3)
• kvm_open(3)
• kvm_openfiles(3)
• kvm_read(3)
• kvm_write(3)

🦋 HISTORY 🦋

The kvm_nlist2() function first appeared in FreeBSD 11.0. periodt.

---

source/version: Debian; date: November 27, 2015; this page is KVM_NLIST(3) — byeee, bestie 🫶💖