如何用crash找到进程完整的命令

最新推荐文章于 2025-05-05 16:49:34 发布

原创最新推荐文章于 2025-05-05 16:49:34 发布 · 2k 阅读

4 ·

CC 4.0 BY-SA版权

本文介绍如何使用Crash工具解析Linux系统中运行的Ping命令及其参数。通过展示具体的Crash命令操作步骤，如获取进程信息、内存映射详情等，帮助读者理解如何深入解析进程的执行状态。

如果仅仅是找到命令本身，task_struct.comm就够了，如果要找到后面的参数则需要花些功夫：

crash> ps | grep ping
  23552  23216   7  ffff8fd784dfc500  IN   0.0  135716   3896  ping
crash> task_struct.comm ffff8fd784dfc500
  comm = "ping\000 server\000\000\000"
crash> task_struct.mm ffff8fd784dfc500
  mm = 0xffff8fd7844b0c00
crash> mm_struct.arg_start,arg_end 0xffff8fd7844b0c00
    arg_start = 0x7ffcd3d0d5b9
    arg_end = 0x7ffcd3d0d5cb
crash> vtop 0x7ffcd3d0d5b9 -c ffff8fd784dfc500
VIRTUAL     PHYSICAL
7ffcd3d0d5b9  805e975b9

   PGD: 82a74e7f8 => 8000000844c1b067
   PUD: 844c1bf98 => 80a9bd067
   PMD: 80a9bd4f0 => 80b1e3067
   PTE: 80b1e3868 => 8000000805e97067
  PAGE: 805e97000

      PTE         PHYSICAL   FLAGS
8000000805e97067  805e97000  (PRESENT|RW|USER|ACCESSED|DIRTY|NX)

      VMA           START       END     FLAGS FILE
ffff8fdf91282d48 7ffcd3ced000 7ffcd3d0e000 100173

      PAGE        PHYSICAL      MAPPING       INDEX CNT FLAGS
ffffea916017a5c0 805e97000 ffff8fd74c33ee71 7fffffffe  1 17ffffc0080036 referenced,uptodate,lru,active,swapbacked
crash> vtop 0x7ffcd3d0d5cb -c ffff8fd784dfc500
VIRTUAL     PHYSICAL
7ffcd3d0d5cb  805e975cb

   PGD: 82a74e7f8 => 8000000844c1b067
   PUD: 844c1bf98 => 80a9bd067
   PMD: 80a9bd4f0 => 80b1e3067
   PTE: 80b1e3868 => 8000000805e97067
  PAGE: 805e97000

      PTE         PHYSICAL   FLAGS
8000000805e97067  805e97000  (PRESENT|RW|USER|ACCESSED|DIRTY|NX)

      VMA           START       END     FLAGS FILE
ffff8fdf91282d48 7ffcd3ced000 7ffcd3d0e000 100173

      PAGE        PHYSICAL      MAPPING       INDEX CNT FLAGS
ffffea916017a5c0 805e97000 ffff8fd74c33ee71 7fffffffe  1 17ffffc0080036 referenced,uptodate,lru,active,swapbacked
crash> rd -p 805e975b9 -e 805e975cb
       805e975b9:  32393100676e6970 312e312e3836312e   ping.192.168.1.1

完整的命令就是"ping 192.168.1.1"