Trusting kernel drivers is bad. Is there something we can do to have at least an idea about what it does?
For example, let's suppose an armv8a linux kernel. I'd search for all the syscalls, which according to https://stackoverflow.com/a/12951533, are the
SVC commands. They should contain the number of the syscalls and I could find which functions of the kernel are being called. But this is for syscalls only.
However, a kernel module can use other symbols, which I don't know how to find.
Also, I don't know if it's possible to do this in armv8a, but couldn't the kernel module code generate a binary data in RAM and branch to it, and this block could contain a syscall by itself? This wouldn't appear in a static analysis of the kernel module, because it happens in runtime.
I'm trying to get into this world of binary analysis and I'm a little lost.