I just shipped a major new feature to my embedded linux auditing tool - the ability to audit the kernel on embedded hosts. The agent that runs on the embedded host sends kernel information to the companion APIs, which then build a compatible kernel module that then gets loaded by the agent on the target host. Then the agent can communicate with the kernel module to do things like read/write physical memory, convert virtual addresses to physical address, etc.