Expanded search capability for crash
----- Original Message -----
> This patch adds options to crash's search command that allow searches
> for character strings (-c), unsigned hexadecimal integer values (-w),
> and unsigned hexadecimal short values (-h). The integer and short
> values are searched on integer and short alignments respectively.
> Strings are searched across contiguous page boundaries, which can cause
> possibly confusing behavior since contiguity is affected by the type of
> search. For example, a page-crossing string found in a user virtual
> address search might not be found in a kernel virtual address search if
> the kernel pages mapped to the user address space are not contiguous.
> The patch is for crash-5.1.2 and has been tested on an x86_64 system.
This looks good -- let me play around with it for a bit...
> Some last minute caveats on with search due to the parser (worth putting
> in help?):
> All numbers are interpreted as hex numbers, regardless of starting
That's always been in the help page:
crash> help search
search - search memory
search [-s start | -[kKV] | -u | -p ] [-e end | -l length] [-m mask] value ...
... [ cut ] ...
-m mask Ignore the bits that are set in the hexadecimal mask value.
value Search for this hexadecimal value.
> Double quotes are magic to crash's parser, so strings of almost anything
> can be enclosed in "", for example: "can't".
> Single quotes mean nothing, so searching for 'dog' is the same as
> searching for "'dog'".
Yeah, I understand that encompassing double-quotes are not necessary
if the string has no spaces, but I think that the use of encompassing quotes
should be encouraged in the help page. Your example shows it, but the
the description of -c doesn't.
And thinking about it, it would be impossible (as-is) to search for a string
that has a double-quote character in it. Not sure whether it's worth
going down the road of trying to handle that.
Anyway, this looks good.
Crash-utility mailing list