$ xref live resolve
On this page
Translate addresses between the binary on disk and a running process: a static address (as printed by every static command) becomes the runtime address in this process, and a runtime address (from a debugger, a crash log, perf) becomes the static one. The translation uses the verified PIE slide and the PT_LOAD segments.
Usage
xref live resolve [OPTIONS] --pid <PID> <ADDR>...
Arguments and options
Arguments
<ADDR>...0x... hex or decimal).Options
--pid <PID>--force-bin--bin does not match /proc/<pid>/exe.--jsonschema_version: 1 JSON output.Examples
The target is ripgrep 14.1.1 (rg) filtering an endless input stream, as on live maps. PIDs and runtime addresses belong to that run.
Static to runtime
0x10b0c0 is one of ripgrep's hottest functions in the profile:
$ xref -b rg live resolve --pid 4084848 0x10b0c0
pid 4084848 starttime 1480887835 match verified_sha256 pie_slide +0x75a99f000000 alive true changed false 0x10b0c0 static_to_runtime static 0x10b0c0 runtime 0x75a99f10b0c0 file 0x10b0c0 sym - /srv/xref-docs/rg+0x10b0c0
Reading the output
- After the identity header, one line per address: the direction (
static_to_runtimeorruntime_to_static), both addresses, the file offset, the symbol if the binary has one, andmodule+offset.
Limits
- Addresses outside the executable's mappings (shared libraries, heap) have no static counterpart and are reported as such.
Provenance
Recorded with a development build of xref after 0.4.0 on Linux x86-64, on rg = ripgrep 14.1.1 (official stripped release). Live examples ran against one ripgrep process filtering an endless input stream; commands shown with sudo ran as root. Output is unchanged except that whitespace at the end of each line and empty lines at the end of the output are removed; long outputs are cut where marked.
Source: docs/cli/live-resolve.md · generated for the site; edit the Markdown, not this page.