Just to follow up on this if anyone is interested, the \M command was horribly inefficient. So I had to rely on making my own dcmd (actually piggy backed on another) to do this for me in the dump that I captured with all user data in it.
I used the mdb_test module mdb_test.so and reimplimented cmd_pread to do what I wanted. Then I loaded up the resulting mdb_test.so via ::load into mdb and my search was done rather quickly. I ended up changing the guts to be: alloc_bytes = MIN(nbytes, 8192); buf = mdb_alloc(alloc_bytes, UM_SLEEP | UM_GC); for (i = 0; i < nbytes; i+= rbytes) { rbytes = mdb_pread(buf, alloc_bytes, paddr+i); if (rbytes >= 0) { for (j = 0; j < rbytes/8; j++) if ((buf[j] & 0x3fffffffffff) == 0x300000400000){ mdb_printf("0x%llx\t0x%llx\n", paddr+i+(j*8), buf[j]); } } else { mdb_printf("Ended at 0x%llx\n", paddr+i); break; } } Then PA::pread nbytes worked like a charm for my specific instance. Modifying ::kgrep to accept a -p flag would probably be the best way to go about fixing this but this hack was much quicker and got the job done. This message posted from opensolaris.org