Hi Evtim, Evtim Batchev wrote: > > > Maybe mdb zfs module may bring may bring some mising zdb > functionality in mdb? > > I will have to go trough your presentation morecarefully to > inderstand better the isues :-) There are two basic issues with using mdb to examine on-disk zfs data/metadata. One is that mdb does not load any CTF information when the target file is a raw disk (or any target that is not ELF or ELF generated core file). The second issue is that most of the metadata is compressed. The first issue is handled by adding a "::loadctf" command and changing some entry points in mdb_tgt_ops_t in cmd/mdb/common/mdb/mdb_rawfile.c. Currently, "::loadctf" only loads the current kernel CTF information. This allows me to use "::print" with raw disks/files. The second issue is handled by adding missing functionality to zdb so that data can be de-compressed.
It would be nice to have mdb handle the decompression, but "::print" reads each field within a structure separately. This means that the data must be de-compressed before using ::print. I have looked into modifying zdb to be interactive, then adding the ::print functionality to zdb. I have also looked into modifying mdb to do the de-compression. I think either of these would work, but will take more time to implement. If mdb is truly a "modular" debugger, it should not only be modular in terms of functionality that can be added, but also in terms of the "modules" that can be debugged. At any rate, I am currently looking into using the modified mdb to understand/correct a problem I am having with a pcfs (fat32) file system. I also will take a short look at "recovering" removed files in a zfs file system. max > > Thanks again > Cheers > E- > > max at bruningsystems.com wrote: >> Hi, >> I just now saw this page: >> http://opensolaris.org/os/project/forensics/ZFS-Forensics/ on the >> forensics project, >> and thought you might like to add the paper and slides I presented at >> the OpenSolaris Developer Conference >> on ZFS on-disk format. The paper is at: >> http://www.osdevcon.org/2008/files/osdevcon2008-proceedings.pdf >> starting at page 36, and the slides are at: >> http://www.osdevcon.org/2008/files/osdevcon2008-max.pdf. >> >> max >> >> _______________________________________________ >> security-discuss mailing list >> security-discuss at opensolaris.org >> > >
