如果只考虑一个程序的话，那么可以研究应用程序本身、它的动态链接库和内核源代码。
If there were only the one program, a worthwhile approach would be to scour the application, its dynamically linked libraries, and the kernel sources.
内核可执行文件由许多链接在一起的对象文件组成。
The kernel executable consists of many object files linked together.
它本身可以在内核中，也可以在静态或动态链接到内核的设备驱动例程中。
It could be in the kernel core per se, or in a device driver that is linked into the kernel either statically or dynamically.
应用推荐