如果仅仅是找到命令本身,task_struct.comm就够了,如果要找到后面的参数则需要花些功夫:
crash> ps | grep ping
23552 23216 7 ffff8fd784dfc500 IN 0.0 135716 3896 ping
crash> task_struct.comm ffff8fd784dfc500
comm = "ping\000 server\000\000\000"
crash> task_struct.mm ffff8fd784dfc500
mm = 0xffff8fd7844b0c00
crash> mm_struct.arg_start,arg_end 0xffff8fd7844b0c00
arg_start = 0x7ffcd3d0d5b9
arg_end = 0x7ffcd3d0d5cb
crash> vtop 0x7ffcd3d0d5b9 -c ffff8fd784dfc500
VIRTUAL PHYSICAL
7ffcd3d0d5b9 805e975b9
PGD: 82a74e7f8 => 8000000844c1b067
PUD: 844c1bf98 => 80a9bd067
PMD: 80a9bd4f0 => 80b1e3067
PTE: 80b1e3868 => 8000000805e97067
PAGE: 805e97000
PTE PHYSICAL FLAGS
8000000805e97067 805e97000 (PRESENT|RW|USER|ACCESSED|DIRTY|NX)
VMA START END FLAGS FILE
ffff8fdf91282d48 7ffcd3ced000 7ffcd3d0e000 100173
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
ffffea916017a5c0 805e97000 ffff8fd74c33ee71 7fffffffe 1 17ffffc0080036 referenced,uptodate,lru,active,swapbacked
crash> vtop 0x7ffcd3d0d5cb -c ffff8fd784dfc500
VIRTUAL PHYSICAL
7ffcd3d0d5cb 805e975cb
PGD: 82a74e7f8 => 8000000844c1b067
PUD: 844c1bf98 => 80a9bd067
PMD: 80a9bd4f0 => 80b1e3067
PTE: 80b1e3868 => 8000000805e97067
PAGE: 805e97000
PTE PHYSICAL FLAGS
8000000805e97067 805e97000 (PRESENT|RW|USER|ACCESSED|DIRTY|NX)
VMA START END FLAGS FILE
ffff8fdf91282d48 7ffcd3ced000 7ffcd3d0e000 100173
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
ffffea916017a5c0 805e97000 ffff8fd74c33ee71 7fffffffe 1 17ffffc0080036 referenced,uptodate,lru,active,swapbacked
crash> rd -p 805e975b9 -e 805e975cb
805e975b9: 32393100676e6970 312e312e3836312e ping.192.168.1.1
完整的命令就是"ping 192.168.1.1"