hi,
i dump the whole memory of a KVM guest out using "dump-guest-memory". as a
result, now i have a big ELF file. i want to use "crash" to analyze this
dump file.
the question is: given the RIP address of an instruction in the KVM guest -
for example 0x12345, which is virtual address, how can "crash" tell me
where in the dump is the position of 0x12345? is there such a command for
this?
my intention is to locate the place, and analyze the assembly instruction
around that RIP to see what is running at the time i dumped the KVM memory.
thank a lot,
Jun