Re: Parsing Structures postmortem from memory dump

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
From: Dan Noé
Date: Tuesday, May 6, 2008 - 3:37 pm

Adrian Sud wrote:

The task_struct structures are stored on one or more lists.  Note the 
list_head types within the structure - each of this is a list that the 
structure is (potentially) a member of.

This is a good explanation of how the kernel's lists work:

http://kernelnewbies.org/FAQ/LinkedLists

I don't know if a generalized printer/parser exists for the kernel 
linked list, but this might be a good way to start exploring your 
project.  There are macros to traverse the lists easily, so it shouldn't 
be too difficult.

Hope that helps.

Cheers,
Dan

-- 
                     /--------------- - -  -  -   -   -
                     |  Dan Noé
                     |  http://isomerica.net/~dpn/
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
Parsing Structures postmortem from memory dump, Adrian Sud, (Tue May 6, 12:04 pm)
Re: Parsing Structures postmortem from memory dump, Dan Noé, (Tue May 6, 3:37 pm)