| 49 | namespace { |
| 50 | |
| 51 | void usage() { |
| 52 | fmt::print(stderr, |
| 53 | "MemNixFS " LMPFS_VERSION "\n" |
| 54 | "Usage:\n" |
| 55 | " memnixfs --dump <file> [--symbols <path>] [--auto-fetch] [command]\n" |
| 56 | "\n" |
| 57 | "Primary command (the whole point of this project):\n" |
| 58 | #ifdef LMPFS_HAS_WINFSP |
| 59 | " mount <pt> Mount as a Windows filesystem via WinFsp.\n" |
| 60 | " <pt> is a drive letter (e.g. M:) or an empty\n" |
| 61 | " directory. Once mounted, browse the dump in\n" |
| 62 | " Explorer / cmd / PowerShell like any disk:\n" |
| 63 | " M:\\fs\\ reconstructed root filesystem\n" |
| 64 | " M:\\proc\\ per-process analysis dirs\n" |
| 65 | " M:\\sys\\ kernel diagnostics\n" |
| 66 | " M:\\files\\ page-cache file recovery\n" |
| 67 | " M:\\mem\\ phys.raw + helpers\n" |
| 68 | #elif defined(LMPFS_HAS_FUSE) |
| 69 | " mount <pt> Mount as a read-only FUSE filesystem.\n" |
| 70 | " <pt> is an existing empty directory. Browse it\n" |
| 71 | " with ls/cat/find like any mounted filesystem:\n" |
| 72 | " <pt>/fs reconstructed root filesystem\n" |
| 73 | " <pt>/proc per-process analysis dirs\n" |
| 74 | " <pt>/sys kernel diagnostics\n" |
| 75 | " <pt>/files page-cache file recovery\n" |
| 76 | " <pt>/mem phys.raw + helpers\n" |
| 77 | #else |
| 78 | " mount (UNAVAILABLE - build with WinFsp on Windows\n" |
| 79 | " or FUSE on Linux.)\n" |
| 80 | #endif |
| 81 | "\n" |
| 82 | "Other commands (CLI smoke tests over the same VFS):\n" |
| 83 | " (no command) Short overview + suggested next commands\n" |
| 84 | " list List processes (full table)\n" |
| 85 | " tree Print the VFS tree\n" |
| 86 | " cat <vfs-path> Dump a single VFS file to stdout. Pair with\n" |
| 87 | " --offset OFF --length LEN to window into huge\n" |
| 88 | " streams (e.g. /mem/kern_va.raw, /mem/phys.raw).\n" |
| 89 | " OFF/LEN accept 0x... hex, decimal, or K/M/G/T\n" |
| 90 | " suffix (e.g. --offset 0x80000000 --length 64K).\n" |
| 91 | " export [PATH] DIR Write the VFS to a real folder. Whole tree is\n" |
| 92 | " huge; pass a subtree, e.g. 'export /csv out' to\n" |
| 93 | " dump just the CSV exports as real files.\n" |
| 94 | " kallsyms [name] Extract kernel symbols straight from the dump\n" |
| 95 | " (no ISF needed). With [name], print just that symbol.\n" |
| 96 | " dmesg Print the kernel's printk ring buffer\n" |
| 97 | " (/var/log/kern.log-style timestamped messages).\n" |
| 98 | "\n" |
| 99 | "Symbol resolution (each step tried in turn):\n" |
| 100 | " --symbols PATH Explicit ISF .json[.xz] file OR a directory to\n" |
| 101 | " search; omit to auto-discover from caches.\n" |
| 102 | " --vmlinux PATH Generate ISF from this user-supplied vmlinux\n" |
| 103 | " (offline; runs dwarf2json via WSL on Windows).\n" |
| 104 | " Highest-leverage escape hatch for custom kernels.\n" |
| 105 | " --symbol-cache DIR Directory where auto-downloaded / generated ISFs\n" |
| 106 | " are SAVED (and searched first on the next run).\n" |
| 107 | " Overrides $LMPFS_SYMBOL_CACHE and the default\n" |
| 108 | " %%LOCALAPPDATA%%/MemNixFS/symbols. Created if absent.\n" |