1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
##################################################################
###
### FILE HEADER
###
@0x0000
"KDUMP " # signature
00000006 # header version
# utsname:
"Linux" 00*60 # sysname
"kdump" 00*60 # nodename
"6.4.3-1-pae" 00*54 # release
"#1 SMP Tue Jul 11 11:31:04 UTC 2023" 00*30 # version
"i686" 00*61 # machine
00*65 # domainname
00*2 # 2-byte hole
64ad9861 # timestamp.tv_sec
00000000 # timestamp.tv_usec
00000000 # status
00001000 # block_size
00000001 # sub_hdr_size
00000002 # bitmap_blocks
00000001 # max_mapnr
00000000 # total_ram_blocks
00000000 # device_blocks (unused)
00000000 # written_blocks (unused)
00000000 # current_cpu
00000001 # nr_cpus
# tasks[] (unused)
##################################################################
###
### SUB-HEADER
###
@0x1000
00000000 # phys_base
00000000 # dump_level
00000000 # split
00000000 # start_pfn
00000000 # end_pfn
00000000000012bc # offset_vmcoreinfo
00000039 # size_vmcoreinfo
0000000000001200 # offset_note
000000f8 # size_note
0000000000005018 # offset_eraseinfo
00000015 # size_eraseinfo
0000000000000000 # start_pfn_64
0000000000000000 # end_pfn_64
0000000000000001 # max_mapnr_64
##################################################################
###
### ELF NOTES
###
@0x1200
# PRSTATUS:
00000005 # n_namesz
00000090 # n_descsz
00000001 # n_type (NT_PRSTATUS)
"CORE" 00*4 # note name
00000000 # pr_info.si_signo
00000000 # pr_info.si_code
00000000 # pr_info.si_errno
0000 # pr_cursig
00*2 # 2-byte hole
00000000 # pr_sigpend
00000000 # pr_sighold
00000dd3 # pr_pid
00000000 # pr_ppid
00000000 # pr_pgrp
00000000 # pr_sid
00000000 # pr_utime.tv_sec
00000000 # pr_utime.tv_usec
00000000 # pr_stime.tv_sec
00000000 # pr_stime.tv_usec
00000000 # pr_cutime.tv_sec
00000000 # pr_cutime.tv_usec
00000000 # pr_cstime.tv_sec
00000000 # pr_cstime.tv_usec
c0887480 # pr_reg[0] (ebx)
00003c3c # pr_reg[1] (ecx)
00000000 # pr_reg[2] (edx)
00000063 # pr_reg[3] (esi)
00000000 # pr_reg[4] (edi)
00000001 # pr_reg[5] (ebp)
00000063 # pr_reg[6] (eax)
0000007b # pr_reg[7] (ds)
0000007b # pr_reg[8] (es)
000000d8 # pr_reg[9] (fs)
00000033 # pr_reg[10] (gs)
ffffffff # pr_reg[11] (orig_eax)
c04b0b5f # pr_reg[12] (eip)
00000060 # pr_reg[13] (cs)
00010092 # pr_reg[14] (eflags)
d15eff34 # pr_reg[15] (esp)
00000068 # pr_reg[16] (ss)
00000000 # pr_fpvalid
# VMCOREINFO:
0000000b # n_namesz
00000039 # n_descsz
00000000 # t_type (zero)
"VMCOREINFO" 00*2 # note name
"OSRELEASE=6.4.3-1-pae\n"
"PAGESIZE=4096\n"
"CRASHTIME=1689098337\n"
##################################################################
###
### ERASEINFO
###
@0x5018
"erase modules size 8\n"
##################################################################
###
### BITMAP BLOCKS
###
@0x2000
01
@0x3000
01
##################################################################
###
### PAGE DATA
###
@0x4000
0000000000004018 # offset
00001000 # size
00000000 # flags (uncompressed)
0000000000000000 # page_flags
@0x4018
# data to be appended here..
|
