I'm debugging a new driver module using kdump and crash, which is great. However, I need to extract a large binary trace buffer for analysis by a project-specific program. The buffer contains trace entries, most of which contain pointers to strings and other stuff outside the trace buffer. So my trace analyzer needs to get the big buffer, and than read other virtual addresses referenced by the big buffer.

On live kernels, my trace module facilitates grabbing the necessary memory via ioctls in my trace module (In 2.4 I used /dev/kmem, but that stopped working in early 2.6, and I don't know the current state since the current approach works fine). I need a way to do the same thing from a vmcore file.

Clearly the answer is in the crash program source code, but I'm wondering if there is a "libcrash" or "libvmcore" or some such that might save me some time in that area.

Thanks for any suggestions,
John Groves