0.1.0 (Released February 19th, 2026)

These are some of the highlights of drgn 0.1.0. See the GitHub release for the full release notes, including more improvements and bug fixes.

Crash Compatibility Mode

This release adds a compatibility mode emulating the crash utility. Most commands have been ported. Ported commands also have a --drgn option that prints example drgn code for doing the equivalent of the command. This helps users transition from crash’s UI to drgn’s programmable API.

Crash compatibility mode can be accessed with %crash from the drgn CLI or directly with the new drgn-crash script.

$ drgn-crash vmlinux vmcore
      KERNEL: vmlinux
    DUMPFILE: vmcore
        CPUS: 8
        DATE: Wed Feb 18 15:37:47 PST 2026
      UPTIME: 66 days, 17:31:41
...
crash> ps
           PID     PPID  CPU        TASK        ST  %MEM         VSZ     RSS  COMM
>        0        0    0  ffffffff9fe130c0  R    0.0           0       0  [swapper/0]
         0        0    1  ffff8a0ac16d0000  R    0.0           0       0  [swapper/1]
         1        0    5  ffff8a0ac10d8000  S    0.1       36132   15864  systemd
...
crash> ps --drgn
from drgn.helpers.linux.mm import task_rss, task_vsize, totalram_pages
from drgn.helpers.linux.pid import for_each_task
from drgn.helpers.linux.sched import task_cpu, task_state_to_char


total_mem = totalram_pages()

for task in for_each_task(idle=True):
    pid = task.pid
    ppid = task.parent.pid
    cpu = task_cpu(task)
    state = task_state_to_char(task)
    rss = task_rss(task)
    mem_usage = rss.total / total_mem
    vsize = task_vsize(task)
    comm = task.comm

See Crash Compatibility for a full list of supported commands and options.

If you find that a command, option, or other feature that you want is missing, please open a GitHub issue. In particular, drgn does not support all dump formats that crash supports, and a few commands and options were left for later, but those can be addressed if requested.

Built-in Commands

drgn now provides a few built-in commands accessed by starting a line with the % character.

py runs Python code, allowing its output to be piped or redirected:

>>> %py stack_trace(1) | grep poll
#5  ep_poll (fs/eventpoll.c:2028:6)
#6  do_epoll_wait (fs/eventpoll.c:2473:9)
#7  __do_sys_epoll_wait (fs/eventpoll.c:2481:9)
#8  __se_sys_epoll_wait (fs/eventpoll.c:2476:1)
#9  __x64_sys_epoll_wait (fs/eventpoll.c:2476:1)

sh executes a shell command:

>>> %sh $EDITOR my_script.py

source runs a script:

>>> %source my_script.py

Memory Searching

This release adds several functions for searching for values or patterns in memory. drgn.search_memory() can search for strings, byte strings, integers, or drgn.Objects:

for address in search_memory(b"VMCOREINFO"):
    print(hex(address))

ptr = stack_trace(pid)[2]["ptr"]
for address in search_memory(ptr):
    print(hex(address))

drgn.search_memory_u16(), drgn.search_memory_u32(), drgn.search_memory_u64(), and drgn.search_memory_word() can search for exact integers, values with a mask, or ranges:

for address, value in search_memory_word(
    0xdead000000000100, 0xdead000000000122
):
    print(hex(address), hex(value))

for address, value in search_memory_word(
    0xdead000000000000, ignore_mask=0xffff
):
    print(hex(address), hex(value))

obj = prog["obj"]
for address, value in search_memory_word(
    (obj.address_, obj.address_ + sizeof(obj) - 1)
):
    print(hex(address), hex(value))

drgn.search_memory_regex() can search for regular expression matches:

# Search for anything that looks like root's password encrypted in
# /etc/shadow.
for address, match in search_memory_regex(rb"root:\$\w+\$[ -9;-~]+:"):
    print(hex(address), match)

The memory range to search can be limited; see drgn.MemorySearchIterator.

Address to Source Code Location Lookups

drgn.source_location() was added. It looks up the file, line number, column number, and function name of a given code address, similar to addr2line(1). It handles function inlining, returning multiple locations when applicable:

>>> source_location("__schedule")
__schedule at kernel/sched/core.c:6646:1
>>> source_location("__schedule+0x2b6")
#0  context_switch at kernel/sched/core.c:5381:9
#1  __schedule at kernel/sched/core.c:6765:8
>>> source_location(0xffffffffb64d70a6)
#0  context_switch at kernel/sched/core.c:5381:9
#1  __schedule at kernel/sched/core.c:6765:8

drgn.StackFrame.source() now returns a drgn.SourceLocation named tuple instead of a plain tuple, providing named access to the file, line, column, and function name.

Many More Helpers

This release adds another 80+ helpers for various subsystems.

• blk_mq_rq_from_pdu()

• blk_mq_rq_to_pdu()

• blk_rq_bytes()

• blk_rq_pos()

• op_is_write()

• req_op()

• request_queue_busy_iter()

• rq_data_dir()

• bpf_map_by_id()

• bpf_prog_by_id()

• bpf_prog_used_maps()

• completion_done()

• completion_for_each_task()

• cpumask_of()

• for_each_registered_blkdev()

• for_each_registered_chrdev()

• address_space_for_each_page()

• decode_file_type()

• inode_for_each_page()

• for_each_resource()

• decode_sysv_shm_flags()

• decode_sysv_shm_mode_flags()

• find_sysv_msg_queue()

• find_sysv_sem_array()

• find_sysv_shm()

• for_each_sysv_msg_queue()

• for_each_sysv_sem_array()

• for_each_sysv_shm()

• for_each_irq_desc()

• gate_desc_func()

• irq_desc_action_names()

• irq_desc_affinity_mask()

• irq_desc_chip_name()

• irq_desc_kstat_cpu()

• irq_to_desc()

• task_is_kthread()

• mutex_owner()

• rwsem_locked()

• rwsem_owner()

• decode_memory_block_state_value()

• mm_cmdline()

• mm_environ()

• task_vsize()

• vma_name()

• for_each_netdev()

• netdev_ipv4_addrs()

• netdev_ipv6_addrs()

• netdev_name()

• for_each_pci_dev()

• for_each_pci_root_bus()

• pci_bus_for_each_child()

• pci_bus_for_each_dev()

• pci_bus_name()

• pci_is_bridge()

• pci_name()

• pci_pcie_type()

• task_rlimits()

• sbitmap_for_each_set()

• cfs_rq_for_each_entity()

• rq_for_each_fair_task()

• rq_for_each_rt_task()

• sched_entity_is_task()

• sched_entity_to_task()

• task_group_name()

• thread_group_leader()

• decode_sigaction_flags()

• decode_sigaction_flags_value()

• decode_sigset()

• sigaction_flags()

• signal_names()

• signal_numbers()

• sigpending_for_each()

• sigset_to_hex()

• kernel_stack_trace()

• swait_active()

• swait_for_each_task()

• ktime_to_ns()

• hrtimer_clock_base_for_each()

• timer_base_for_each()

• timer_base_names()

• kuid_val()

Implicit Type Lookups for sizeof(), alignof(), offsetof(), etc.

drgn.sizeof(), drgn.alignof(), drgn.offsetof(), drgn.helpers.common.type.member_at_offset(), and drgn.helpers.common.type.typeof_member() now accept the type or object argument as a string, which is looked up in the default program. This avoids the need to manually look up a type first:

>>> sizeof("struct task_struct")
9728
>>> alignof("struct page")
16
>>> offsetof("struct task_struct", "comm")
3248

Linux 6.19 and Tentative 7.0 Support

A change in Linux 6.19 broke drgn.helpers.linux.mm.decode_memory_block_state(). This error is fixed in this release:

>>> decode_memory_block_state(mem)
Traceback (most recent call last):
  ...
KeyError: 0

A change in Linux 6.19 broke module_taints(). This error is fixed in this release:

AttributeError: 'struct taint_flag' has no member 'module'

This release of drgn precedes the release of Linux 7.0 by a few days, but a couple of breakages introduced during the merge window have been addressed.

A change in the Linux 7.0 merge window broke load_vmlinux_kallsyms(). This error is fixed in this release:

>>> drgn.helpers.linux.kallsyms._load_builtin_kallsyms(prog)
Traceback (most recent call last):
  ...
_drgn.FaultError: address is not mapped: 0x0

The transition to sheaves in the slab allocator in the Linux 7.0 merge window made slab_cache_for_each_allocated_object(), slab_cache_usage(), slab_object_info(), and related helpers return inaccurate information. That was fixed in this release. Note that this also affected slab caches that opted into sheaves in Linux 6.18 and 6.19.