hi,
i dump the whole memory of a KVM guest out using "dump-guest-memory". as a result, now i have a big ELF file. i want to use "crash" to analyze this dump file.
the question is: given the RIP address of an instruction in the KVM guest - for example 0x12345, which is virtual address, how can "crash" tell me where in the dump is the position of 0x12345? is there such a command for this?
my intention is to locate the place, and analyze the assembly instruction around that RIP to see what is running at the time i dumped the KVM memory.