This website requires JavaScript.
Explore
Help
Sign In
OpenE2K
/
qemu-e2k
Watch
13
Star
4
Fork
You've already forked qemu-e2k
0
Code
Issues
4
Pull Requests
Projects
2
Releases
Activity
9399ef1683
qemu-e2k
/
contrib
/
elf2dmp
/
Makefile.objs
2 lines
63 B
Makefile
Raw
Normal View
History
Unescape
Escape
contrib: add elf2dmp tool elf2dmp is a converter from ELF dump (produced by 'dump-guest-memory') to Windows MEMORY.DMP format (also know as 'Complete Memory Dump') which can be opened in WinDbg. This tool can help if VMCoreInfo device/driver is absent in Windows VM and 'dump-guest-memory -w' is not available but dump can be created in ELF format. The tool works as follows: 1. Determine the system paging root looking at GS_BASE or KERNEL_GS_BASE to locate the PRCB structure and finds the kernel CR3 nearby if QEMU CPU state CR3 is not suitable. 2. Find an address within the kernel image by dereferencing the first IDT entry and scans virtual memory upwards until the start of the kernel. 3. Download a PDB matching the kernel from the Microsoft symbol store, and figure out the layout of certain relevant structures necessary for the dump. 4. Populate the corresponding structures in the memory image and create the appropriate dump header. Signed-off-by: Viktor Prutyanov <viktor.prutyanov@virtuozzo.com> Message-Id: <1535546488-30208-3-git-send-email-viktor.prutyanov@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-29 14:41:25 +02:00
elf2dmp-obj-y
=
main.o addrspace.o download.o pdb.o qemu_elf.o