On Wed, Mar 6, 2013 at 4:00 AM, Lei Wen <adrian.wenl(a)gmail.com> wrote:
Per,
[snip..]
>
> What do you get when you do:
>
> $ nm vmlinux | grep linux_banner
>
> $ readelf -l <dumpfile>
>
> $ strings -a -t x <dumpfile> | grep "Linux version"
Here is the result:
nm vmlinux | grep linux_banner
c05bc06b R linux_banner
readelf -l 2013-01-18
Elf file type is CORE (Core file)
Entry point 0x0
There are 2 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NOTE 0x000074 0x00000000 0x00000000 0x00000 0x00000 0
LOAD 0x000074 0xc0000000 0x00000000 0x20000000 0x20000000 RWE 0
strings -a -t x 2013-01-18 | grep "Linux version"
5bc0df Linux version 3.4.5+ (1@2) (gcc version 4.6.x-google 20120106
(prerelease) (GCC) ) #1 SMP PREEMPT Tue Jan 15 15:51:59 CST 2013
So, the placement in the file seems ok:
0xc0000000+0x5bc0df-0x000074 == 0xc05bc06b
The only alternative I see is that there are overwrites in .text. You
could use dd to pull out that part of both the dump and the vmlinux
and diff them. Beware that there could be some valid reasons for
differences between them though...
/Per
Thanks,
Lei