Device files

/proc//maps

• Lists each memory mapping and the layout of the process image.
• Covers the executable, shared libraries, stack, heap, VDSO, and more.
• The fastest way to see how a process's address space is arranged.

/proc/kcore

• A procfs entry that behaves like a live core file of the Linux kernel.
• It is a raw memory dump in ELF core form, useful with GDB for kernel debugging and analysis.

/boot/System.map

• Available on essentially every Linux distribution and useful for kernel work.
• Holds symbols for the whole kernel.

/proc/kallsyms

• Very close to System.map, except it is managed by the kernel and updated dynamically through a /proc entry.
• Load a new LKM and its symbols show up in /proc/kallsyms right away.
• It includes most symbols, and everything enabled by CONFIG_KALLSYMS_ALL.

/proc/iomem

• Similar to /proc/<pid>/maps, but for system-wide physical memory.
• To find where the kernel text segment sits in physical memory, search for Kernel and check the code/text, data, and bss ranges.