The
kvm_nlist()
function retrieves the symbol table entries indicated by the name list argument
amp;nl.
This argument points to an array of nlist structures, terminated by
an entry whose
n_name
field is
NULL
(see
nlist(3)).
Each symbol is looked up using the
n_name
field, and if found, the
corresponding
n_type
and
n_value
fields are filled in.
These fields are set
to 0 if the symbol is not found.
The
kldsym(2)
system call is used to locate symbols in live kernels.
This is a less than perfect
emulation of the nlist values but has the advantage of being aware of kernel
modules and is reasonably fast.
The
kvm_nlist2()
function retrieves the symbol table entries indicated by the name list argument
nl.
This argument points to an array of
struct kvm_nlist
structures,
terminated by an entry whose
n_name
field is
NULL
These structures are similar to the nlist structures used by
kvm_nlist()
except that the
n_value
field uses a different type
(kvaddr_t)
to avoid truncation when examining non-native kernel images.