In this example, we assume that the memory image exists on
the swap device. The following command invokes crash
specifying that it is to read the memory image from
/dev/swap, and use the symbol table in /stand/unix.test:
crash -d /dev/swap -n /stand/unix.test
>Trap number 0 shows that the panic was caused by a divide error. (See the trap(M) manual page for a list of possible CPU exceptions.)
panicSystem Messages: ... ERR=0, TRAPNO=0
cs:eip=0158:f0055862 Flags=10286 ... eax= 00000001 ebx= f11100c0 ecx= 00000000 edx= f0055ac2 ... Kernel Stack before Trap:
STKADDR FRAMEPTR FUNCTION POSSIBLE ARGUMENTS
e0000b94 e0000bc8 panioctl (0xfacd0864,0x1,0,0x1) ...
The first entry in the dump of the kernel stack shows the current stack frame when the panic occurred. This shows that the trap occurred within the routine panioctl.
>This instruction performs an integer long division of the contents of register EAX by the contents of ECX. The contents of these registers shown in the output from panic are 1 and 0 respectively. We can conclude that the panic was caused by the attempt to divide by zero.
dis 0xf0055862panioctl+0xa5 idivl %ecx,%eax
Note that this is a fictitious example; there is no such routine as panioctl in the kernel.