Finding out which Linux process was executing when system locked up by evaluating CPU registers -
i need find out executing when linux (debian) system hangs (x86 platform). managed extract following information before system locked up:
es: 0x7b cs: 0x73 ss: 0x7b ds: 0x7b fs: 0x0 gs: 0x33 ldtbase: 0x0 tr: 0x80 dr7: 0x400 dr6: 0xffff0ff0 eax: 0xbfbde820 ecx: 0xa908f9a0 edx: 0xb708a000 ebx: 0xb71b5278 esp: 0xbfbde730 ebp: 0xbfbde838 esi: 0x9d36b58 edi: 0x9d50bb8 eip: 0xb71b13e8 eflags: 0x203206 cr3: 0x1e9de000 cr0: 0x80050033 from values of segment registers, know when linux hangs, it's on user-space mode. find out process/library causing crash, , ideally exact part of it.
by looking @ cr3 , eip, should able information getting confused. far know, virtual address 0xb71b13e8 relative page table used (0x1e9de000). now, instruction pointer points physical address, right? think should convert (eip value) virtual address offset of page table pointed cr3.
could please me bit on that?
where did extract information from?
if usermode crash/lockup, presumably information core dump (you can dump cores on fly without killing subject)
in case, use gdb /usr/bin/myprogrambinary corefile
and navigate using gdb commands bt, info threads, info shared, thread apply bt full etc
the usefulness of improve debugging symbols various libraries installed on system (depending on distro, install relevant *-dbg packages)
Comments
Post a Comment