Messages in this thread | | | Date | Mon, 20 Jul 2009 17:47:30 +0500 | Subject | [Newbie] Getting pages of files accessed by a process from a RAM image | From | "M. Shuaib Khan" <> |
| |
Hi,
This is a newbie question, and I asked and searched elsewhere but couldn't get a satisfactory answer, so bothering you guys. Please bear with me.
I am trying to get all the pages of files opened by a process, by manually traversing the structures in a RAM image taken using dd. So far what I know is that I can do it using the radix_tree_node, which has data members height, count, and slots, and which I think refer to the level of indirection in slots, the page count, and the addresses of the page frames respectively. Correct? What does the addresses in the slots point to? Page descriptors?
Also, when the nrpages of a file is 1, the height in radix_tree_root is reported as 0, in that case how can we access that single page because we can't get the count and slots addresses in radix_tree_node.
Any input, web pointers welcomed.
Thanks
-- M. Shuaib Khan
| |