From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47740) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WlDhD-0006Nh-1A for qemu-devel@nongnu.org; Fri, 16 May 2014 04:40:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WlDh7-0007aA-GN for qemu-devel@nongnu.org; Fri, 16 May 2014 04:40:50 -0400 Received: from mail-we0-x229.google.com ([2a00:1450:400c:c03::229]:37661) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WlDh6-0007Zz-Te for qemu-devel@nongnu.org; Fri, 16 May 2014 04:40:45 -0400 Received: by mail-we0-f169.google.com with SMTP id u56so2280786wes.0 for ; Fri, 16 May 2014 01:40:44 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <20140516090322.78f174a3@bahia.local> References: <20140516090322.78f174a3@bahia.local> From: Jun Koi Date: Fri, 16 May 2014 16:40:23 +0800 Message-ID: Content-Type: multipart/alternative; boundary=f46d0442877a85ddd404f9805ee7 Subject: Re: [Qemu-devel] dump-guest-memory command? List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Greg Kurz Cc: "qemu-devel@nongnu.org" --f46d0442877a85ddd404f9805ee7 Content-Type: text/plain; charset=UTF-8 On Fri, May 16, 2014 at 3:03 PM, Greg Kurz wrote: > On Fri, 16 May 2014 14:24:16 +0800 > Jun Koi wrote: > > Hi, > > > > Anybody please help me on this dump-guest-memory command? How does the > > virtual memory map to the dumped file? > > > > For example, if x86 register RIP points to 0x12345, how does that map to > > the dump file? Meaning how can I find where this address 0x12345 in the > > dump? > > > > I tried, but couldnt find much documentation on this command. > > > > Thank you a lot, > > Jun > > Hi Jun, > > The dump file is in ELF format and data is written in ELF notes. > Use readelf -a on the file and you'll get something like the > following at the end of the output: > > ... > > Notes at offset 0x000001c8 with length 0x00000328: > Owner Data size Description > CORE 0x00000150 NT_PRSTATUS (prstatus structure) > QEMU 0x000001b0 Unknown note type: (0x00000000) > > The registers sit in the NT_PRSTATUS note (hence somewhere offset > 0x000001c8 and 0x000001c8+0x00000150+0x14 (the latter is the ELF note > header size). Be aware that intel is little endian: if RIP is 0x00012345, > you need to look for '45 23 01 00' in the file. > > Thanks so much, but perhaps you misunderstood my question? What I want to know is how to map 0x12345 (virtual address) back to the dump file. For example, if 0x12345 was executing some filesystem code at the time I dumped the VM, then I can locate exactly that code in the dumpfile, thanks to the given RIP address (which is 0x12345 in this example) I hope I explain my idea clear enough this time? Thanks a lot, Jun --f46d0442877a85ddd404f9805ee7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



On Fri, May 16, 2014 at 3:03 PM, Greg Kurz <gkurz@linux.vne= t.ibm.com> wrote:
On F= ri, 16 May 2014 14:24:16 +0800
Jun Koi <junkoi2004@gmail.com> wrote:
> Hi,
>
> Anybody please help me on this dump-guest-memory command? How does the=
> virtual memory map to the dumped file?
>
> For example, if x86 register RIP points to 0x12345, how does that map = to
> the dump file? Meaning how can I find where this address 0x12345 in th= e
> dump?
>
> I tried, but couldnt find much documentation on this command.
>
> Thank you a lot,
> Jun

Hi Jun,

The dump file is in ELF format and data is written in ELF notes.
Use readelf -a on the file and you'll get something like the
following at the end of the output:

...

Notes at offset 0x000001c8 with length 0x00000328:
=C2=A0 Owner =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Data s= ize =C2=A0 =C2=A0 =C2=A0 Description
=C2=A0 CORE =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0x00000= 150 =C2=A0 =C2=A0 =C2=A0 NT_PRSTATUS (prstatus structure)
=C2=A0 QEMU =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0x00000= 1b0 =C2=A0 =C2=A0 =C2=A0 Unknown note type: (0x00000000)

The registers sit in the NT_PRSTATUS note (hence somewhere offset
0x000001c8 and 0x000001c8+0x00000150+0x14 (the latter is the ELF note
header size). Be aware that intel is little endian: if RIP is 0x00012345, you need to look for '45 23 01 00' in the file.




I hope I explain my idea clear enough this time?
<= div>
--f46d0442877a85ddd404f9805ee7--