Re: [Qemu-devel] dump-guest-memory command?

[Greg Kurz <gkurz@linux.vnet.ibm.com>]

[-- Attachment #1: Type: text/plain, Size: 1533 bytes --]

On Fri, 16 May 2014 14:24:16 +0800
Jun Koi <junkoi2004@gmail.com> wrote:
> Hi,
> 
> Anybody please help me on this dump-guest-memory command? How does the
> virtual memory map to the dumped file?
> 
> For example, if x86 register RIP points to 0x12345, how does that map to
> the dump file? Meaning how can I find where this address 0x12345 in the
> dump?
> 
> I tried, but couldnt find much documentation on this command.
> 
> Thank you a lot,
> Jun

Hi Jun,

The dump file is in ELF format and data is written in ELF notes.
Use readelf -a on the file and you'll get something like the
following at the end of the output:

...

Notes at offset 0x000001c8 with length 0x00000328:
  Owner                 Data size       Description
  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)
  QEMU                 0x000001b0       Unknown note type: (0x00000000)

The registers sit in the NT_PRSTATUS note (hence somewhere offset
0x000001c8 and 0x000001c8+0x00000150+0x14 (the latter is the ELF note
header size). Be aware that intel is little endian: if RIP is 0x00012345,
you need to look for '45 23 01 00' in the file.

The attached script may help to display the dump file content.

Cheers.

-- 
Gregory Kurz                                     kurzgreg@fr.ibm.com
                                                 gkurz@linux.vnet.ibm.com
Software Engineer @ IBM/Meiosys                  http://www.ibm.com
Tel +33 (0)562 165 496

"Anarchy is about taking complete responsibility for yourself."
        Alan Moore.

[-- Attachment #2: elfnote --]
[-- Type: application/octet-stream, Size: 691 bytes --]

#!/bin/bash

usage() {
    cat<<EOF>&2
USAGE: elfnote <corefile> <note pattern>

example: elfnote ./vmcore PRSTATUS will show PRSTATUS (registers)
EOF
    exit 1
}

[[ -n "$1" ]] || usage
file="$1"
shift
[[ -n "$1" ]] || usage
pattern="$1"
shift

notes=( $(readelf -n $file | awk --non-decimal-data \
    "/Notes at offset/ { offset = \$4 } \
     /$pattern/ { print offset + 20 \":\" 0 + \$2 } \
     /CORE|QEMU/ { offset += 20 + \$2 }"))

for note in "${notes[@]}"
do
    offset=${note%:*}
    size=${note#*:}

    printf "offset: 0x%x size: 0x%x\n" $offset $size
    echo "------------------------------------------------------"
    od -A x -t x1 -j $offset -N $size $file
    echo
done