iostat

watch disk performance

ex:

iostat -w 1

display every second

kernel debug

type 14 = page fault

error code: 0: read from a non-present page

2: write to a non-present page

EIP: address of instruction at panic

create symbol file:

/Volumes/KernelDebugKit/createsymbolfiles -s /tmp PanicDriver/build/Debug/PanicDriver.kext

assume 0x223ab275 is EIP address

gdb /Volumes/KernelDebugKit/mach_kernel

--> set kext-symbol-file-path /tmp

--> add-kext ~/test.kext

--> set print asm-demangle on

--> x/i 0x223ab275

find the function mapped to this address

--> disass 0x223ab275

show this function's content

--> info line * 0x223ab275

show the line number of EIP in the function

vifs

edit /etc/fstab

set the disk not automount

UUID=5BFDB0C1-B240-3429-B9B0-20022AFBAA3C /test hfs rw,noauto

transfer visual project to xcode

1. new project -> Standard Tool

2. get visual project from cvs ( not get from visual stdio)

3. copy the files in visual project into this xcode project directory

4. set SCM Repository

driver terminate procedure

requestTerminate

terminate

willTerminate

didTerminate

detach

free

kernel core dump

configure server:

sudo mkdir /PanicDumps

sudo chown root:wheel /PanicDumps

sudo chmod 1777 /PanicDumps

sudo launchctl load -w /Sysytem/Library/LaunchDaemons/com.apple.kdumpd.plist

sudo launchctl list | grep kdump

configure client:

sudo nvram boot-args="debug=0xd44 _panicd_ip=10.10.1.1"

10.10.1.1 is server ip

link with pcap library

-l pcap