qemu/contrib
Viktor Prutyanov 3fa2d384c2 contrib: add elf2dmp tool
elf2dmp is a converter from ELF dump (produced by 'dump-guest-memory') to
Windows MEMORY.DMP format (also know as 'Complete Memory Dump') which can be
opened in WinDbg.

This tool can help if VMCoreInfo device/driver is absent in Windows VM and
'dump-guest-memory -w' is not available but dump can be created in ELF format.

The tool works as follows:
1. Determine the system paging root looking at GS_BASE or KERNEL_GS_BASE
to locate the PRCB structure and finds the kernel CR3 nearby if QEMU CPU
state CR3 is not suitable.
2. Find an address within the kernel image by dereferencing the first
IDT entry and scans virtual memory upwards until the start of the
kernel.
3. Download a PDB matching the kernel from the Microsoft symbol store,
and figure out the layout of certain relevant structures necessary for
the dump.
4. Populate the corresponding structures in the memory image and create
the appropriate dump header.

Signed-off-by: Viktor Prutyanov <viktor.prutyanov@virtuozzo.com>
Message-Id: <1535546488-30208-3-git-send-email-viktor.prutyanov@virtuozzo.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-10-02 19:09:12 +02:00
..
elf2dmp contrib: add elf2dmp tool 2018-10-02 19:09:12 +02:00
ivshmem-client Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
ivshmem-server Move include qemu/option.h from qemu-common.h to actual users 2018-02-09 13:52:16 +01:00
libvhost-user libvhost-user: support host notifier 2018-05-24 21:14:11 +03:00
systemd contrib: add systemd unit files 2017-12-20 22:29:26 +01:00
vhost-user-blk vhost-blk: turn on pre-defined RO feature bit 2018-06-01 19:20:38 +03:00
vhost-user-scsi Use #include "..." for our own headers, <...> for others 2018-02-09 05:05:11 +01:00