title: gdb - debugging kernel with physical memory dump file
body: <p>I have a physical memory dump file and a symbol file (vmlinux), and I'd like to analyze the content of dump file with symbol file in gdb. For example, to peek the state of init_task at that time the physical memory dumped:</p>
  
  <pre><code>(gdb) print &amp;init_task
  =&gt; show the address of init_task in physical memory dump file, said 0xc0XXXXXX
  
  (gdb) print ((struct task_struct *) 0xc0XXXXXX)-&gt;tasks
  =&gt; show the content of init_task.tasks in physical memory dump file)
  </code></pre>
  
  <p>I just tried the gdb commands "restore" and "target core", both are not work. "restore" need to be used on a running process, and "target core" need in core file (ELF 64-bit LSB core file) as input.</p>
  
  <pre><code>(gdb) restore binary physical-memory-dump-file
  You can't do that without a process to debug.
  
  (gdb) target core physical-memory-dump-file
  "physical-memory-dump-file" is not a core dump: File format not recognized
  </code></pre>
  
  <p>Any idea? Thanks.</p>
  
  <p>Update1:
  Hi Pavan, thanks for reminding; since I'm working on special platform, the bootloader on it will save the complete physical memory into the dump file, after kernel reboot from panic / Oops. So the physical-memory-dump-file will have the same size with physical RAM, and it can be mapped to the 0xc000:0000 in kernel from the first byte of it. </p>