[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] dump-guest-memory command?
From: |
Greg Kurz |
Subject: |
Re: [Qemu-devel] dump-guest-memory command? |
Date: |
Fri, 16 May 2014 09:03:22 +0200 |
On Fri, 16 May 2014 14:24:16 +0800
Jun Koi <address@hidden> wrote:
> Hi,
>
> Anybody please help me on this dump-guest-memory command? How does the
> virtual memory map to the dumped file?
>
> For example, if x86 register RIP points to 0x12345, how does that map to
> the dump file? Meaning how can I find where this address 0x12345 in the
> dump?
>
> I tried, but couldnt find much documentation on this command.
>
> Thank you a lot,
> Jun
Hi Jun,
The dump file is in ELF format and data is written in ELF notes.
Use readelf -a on the file and you'll get something like the
following at the end of the output:
...
Notes at offset 0x000001c8 with length 0x00000328:
Owner Data size Description
CORE 0x00000150 NT_PRSTATUS (prstatus structure)
QEMU 0x000001b0 Unknown note type: (0x00000000)
The registers sit in the NT_PRSTATUS note (hence somewhere offset
0x000001c8 and 0x000001c8+0x00000150+0x14 (the latter is the ELF note
header size). Be aware that intel is little endian: if RIP is 0x00012345,
you need to look for '45 23 01 00' in the file.
The attached script may help to display the dump file content.
Cheers.
--
Gregory Kurz address@hidden
address@hidden
Software Engineer @ IBM/Meiosys http://www.ibm.com
Tel +33 (0)562 165 496
"Anarchy is about taking complete responsibility for yourself."
Alan Moore.
elfnote
Description: Binary data
- [Qemu-devel] dump-guest-memory command?, Jun Koi, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?,
Greg Kurz <=
- Re: [Qemu-devel] dump-guest-memory command?, Greg Kurz, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Jun Koi, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Greg Kurz, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Laszlo Ersek, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Jun Koi, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Laszlo Ersek, 2014/05/16