Add a new imgdiag tool to diff boot.art/core.art against a process

Analyze the dirty memory pages of a running process per-object,
this allows is to to fine-tune the dirty object binning algorithm in
image writer.

Also:
* Factor out oatdump command line parsing code into cmdline.h
* Factor out common build rules for building variations of binaries
* Add a gtest for imgdiag

Bug: 17611661
Change-Id: I3ac852a0d223af66f6d59ae5dbc3df101475e3d0

20 files changed, 1848 insertions, 245 deletions

diff --git a/Android.mk b/Android.mk
index d11d011..fd74eae 100644
--- a/Android.mk
+++ b/Android.mk
@@ -101,6 +101,7 @@ include $(art_path)/compiler/Android.mk
 include $(art_path)/dex2oat/Android.mk
 include $(art_path)/disassembler/Android.mk
 include $(art_path)/oatdump/Android.mk
+include $(art_path)/imgdiag/Android.mk
 include $(art_path)/patchoat/Android.mk
 include $(art_path)/dalvikvm/Android.mk
 include $(art_path)/tools/Android.mk
diff --git a/build/Android.common.mk b/build/Android.common.mk
index 39e78fa..00962f5 100644
--- a/build/Android.common.mk
+++ b/build/Android.common.mk
@@ -14,8 +14,8 @@
 # limitations under the License.
 #
 
-ifndef ANDROID_COMMON_MK
-ANDROID_COMMON_MK = true
+ifndef ART_ANDROID_COMMON_MK
+ART_ANDROID_COMMON_MK = true
 
 ART_TARGET_SUPPORTED_ARCH := arm arm64 mips x86 x86_64
 ART_HOST_SUPPORTED_ARCH := x86 x86_64
@@ -81,4 +81,4 @@ else
   2ND_ART_HOST_OUT_SHARED_LIBRARIES := $(2ND_HOST_OUT_SHARED_LIBRARIES)
 endif
 
-endif # ANDROID_COMMON_MK
+endif # ART_ANDROID_COMMON_MK
diff --git a/build/Android.common_build.mk b/build/Android.common_build.mk
index 1a8752f..241715e 100644
--- a/build/Android.common_build.mk
+++ b/build/Android.common_build.mk
@@ -14,10 +14,11 @@
 # limitations under the License.
 #
 
-ifndef ANDROID_COMMON_BUILD_MK
-ANDROID_COMMON_BUILD_MK = true
+ifndef ART_ANDROID_COMMON_BUILD_MK
+ART_ANDROID_COMMON_BUILD_MK = true
 
 include art/build/Android.common.mk
+include art/build/Android.common_utils.mk
 
 # These can be overridden via the environment or by editing to
 # enable/disable certain build configuration.
@@ -330,4 +331,4 @@ ifeq ($(ART_BUILD_HOST_DEBUG),true)
   ART_BUILD_DEBUG := true
 endif
 
-endif # ANDROID_COMMON_BUILD_MK
+endif # ART_ANDROID_COMMON_BUILD_MK
diff --git a/build/Android.common_path.mk b/build/Android.common_path.mk
index 281d189..e0c0b0c 100644
--- a/build/Android.common_path.mk
+++ b/build/Android.common_path.mk
@@ -14,8 +14,8 @@
 # limitations under the License.
 #
 
-ifndef ANDROID_COMMON_PATH_MK
-ANDROID_COMMON_PATH_MK := true
+ifndef ART_ANDROID_COMMON_PATH_MK
+ART_ANDROID_COMMON_PATH_MK := true
 
 include art/build/Android.common.mk
 
@@ -88,4 +88,4 @@ TARGET_CORE_DEX_LOCATIONS := $(foreach jar,$(TARGET_CORE_JARS),/$(DEXPREOPT_BOOT
 
 HOST_CORE_DEX_FILES   := $(foreach jar,$(HOST_CORE_JARS),  $(call intermediates-dir-for,JAVA_LIBRARIES,$(jar),t,COMMON)/javalib.jar)
 TARGET_CORE_DEX_FILES := $(foreach jar,$(TARGET_CORE_JARS),$(call intermediates-dir-for,JAVA_LIBRARIES,$(jar), ,COMMON)/javalib.jar)
-endif # ANDROID_COMMON_PATH_MK
+endif # ART_ANDROID_COMMON_PATH_MK
diff --git a/build/Android.common_test.mk b/build/Android.common_test.mk
index 2493565..0ae42dd 100644
--- a/build/Android.common_test.mk
+++ b/build/Android.common_test.mk
@@ -14,8 +14,8 @@
 # limitations under the License.
 #
 
-ifndef ANDROID_COMMON_TEST_MK
-ANDROID_COMMON_TEST_MK = true
+ifndef ART_ANDROID_COMMON_TEST_MK
+ART_ANDROID_COMMON_TEST_MK = true
 
 include art/build/Android.common_path.mk
 
@@ -197,4 +197,4 @@ define build-art-test-dex
   endif
 endef
 
-endif # ANDROID_COMMON_TEST_MK
+endif # ART_ANDROID_COMMON_TEST_MK
diff --git a/build/Android.common_utils.mk b/build/Android.common_utils.mk
new file mode 100644
index 0000000..8069c3a
--- /dev/null
+++ b/build/Android.common_utils.mk
@@ -0,0 +1,26 @@
+#
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+ifndef ART_ANDROID_COMMON_UTILS_MK
+ART_ANDROID_COMMON_UTILS_MK = true
+
+#
+# Convert a string into an uppercase string.
+#
+# $(1): a string which should be made uppercase
+art-string-to-uppercase = $(shell echo $(1) | tr '[:lower:]' '[:upper:]')
+
+endif # ART_ANDROID_COMMON_UTILS_MK
diff --git a/build/Android.executable.mk b/build/Android.executable.mk
index be97e82..ef9e7cd 100644
--- a/build/Android.executable.mk
+++ b/build/Android.executable.mk
@@ -47,12 +47,13 @@ define build-art-executable
   art_target_or_host := $(5)
   art_ndebug_or_debug := $(6)
   art_multilib := $(7)
+  art_out_binary_name :=
 
   include $(CLEAR_VARS)
   LOCAL_CPP_EXTENSION := $(ART_CPP_EXTENSION)
   LOCAL_MODULE_TAGS := optional
   LOCAL_SRC_FILES := $$(art_source)
-  LOCAL_C_INCLUDES += $(ART_C_INCLUDES) art/runtime $$(art_c_includes)
+  LOCAL_C_INCLUDES += $(ART_C_INCLUDES) art/runtime art/cmdline $$(art_c_includes)
   LOCAL_SHARED_LIBRARIES += $$(art_shared_libraries)
   LOCAL_WHOLE_STATIC_LIBRARIES += libsigchain
 
@@ -91,32 +92,114 @@ define build-art-executable
   endif
 
   LOCAL_ADDITIONAL_DEPENDENCIES := art/build/Android.common_build.mk
+  LOCAL_ADDITIONAL_DEPENDENCIES += art/build/Android.common_utils.mk
   LOCAL_ADDITIONAL_DEPENDENCIES += art/build/Android.executable.mk
 
   ifeq ($$(art_target_or_host),target)
     LOCAL_MODULE_TARGET_ARCH := $(ART_SUPPORTED_ARCH)
   endif
 
-  # If multilib, need to provide stem.
   LOCAL_MULTILIB := $$(art_multilib)
+  art_out_binary_name := $$(LOCAL_MODULE)
+
+  # If multilib=both (potentially building both 32-bit and 64-bit), need to provide stem.
   ifeq ($$(art_multilib),both)
-    ifeq ($$(art_ndebug_or_debug),ndebug)
-      LOCAL_MODULE_STEM_32 := $$(art_executable)32
-      LOCAL_MODULE_STEM_64 := $$(art_executable)
-    else #debug
-      LOCAL_MODULE_STEM_32 := $$(art_executable)d32
-      LOCAL_MODULE_STEM_64 := $$(art_executable)d
+    # Set up a 32-bit/64-bit stem if we are building both binaries.
+    # In this case, the 32-bit binary has an additional 32-bit suffix.
+    LOCAL_MODULE_STEM_32 := $$(LOCAL_MODULE)32
+    LOCAL_MODULE_STEM_64 := $$(LOCAL_MODULE)
+
+    # Remember the binary names so we can add them to the global art executables list later.
+    art_out_binary_name := $$(LOCAL_MODULE_STEM_32) $$(LOCAL_MODULE_STEM_64)
+
+    # For single-architecture targets, remove any binary name suffixes.
+    ifeq ($$(art_target_or_host),target)
+      ifeq (,$(TARGET_2ND_ARCH))
+        LOCAL_MODULE_STEM_32 := $$(LOCAL_MODULE)
+        art_out_binary_name := $$(LOCAL_MODULE)
+      endif
+    endif
+
+    # For single-architecture hosts, remove any binary name suffixes.
+    ifeq ($$(art_target_or_host),host)
+      ifeq (,$(HOST_2ND_ARCH))
+        LOCAL_MODULE_STEM_32 := $$(LOCAL_MODULE)
+        art_out_binary_name := $$(LOCAL_MODULE)
+      endif
     endif
   endif
 
   include external/libcxx/libcxx.mk
   ifeq ($$(art_target_or_host),target)
     include $(BUILD_EXECUTABLE)
-    ART_TARGET_EXECUTABLES := $(ART_TARGET_EXECUTABLES) $(TARGET_OUT_EXECUTABLES)/$$(LOCAL_MODULE)
+    ART_TARGET_EXECUTABLES := $(ART_TARGET_EXECUTABLES) $$(foreach name,$$(art_out_binary_name),$(TARGET_OUT_EXECUTABLES)/$$(name))
   else # host
     LOCAL_IS_HOST_MODULE := true
     include $(BUILD_HOST_EXECUTABLE)
-    ART_HOST_EXECUTABLES := $(ART_HOST_EXECUTABLES) $(HOST_OUT_EXECUTABLES)/$$(LOCAL_MODULE)
+    ART_HOST_EXECUTABLES := $(ART_HOST_EXECUTABLES) $$(foreach name,$$(art_out_binary_name),$(HOST_OUT_EXECUTABLES)/$$(name))
   endif
 
+  # Clear out local variables now that we're done with them.
+  art_executable :=
+  art_source :=
+  art_shared_libraries :=
+  art_c_includes :=
+  art_target_or_host :=
+  art_ndebug_or_debug :=
+  art_multilib :=
+  art_out_binary_name :=
+
+endef
+
+#
+# Build many art executables from multiple variations (debug/ndebug, host/target, 32/64bit).
+# By default only either 32-bit or 64-bit is built (but not both -- see multilib arg).
+# All other variations are gated by ANDROID_BUILD_(TARGET|HOST)_[N]DEBUG.
+# The result must be eval-uated.
+#
+# $(1): executable name
+# $(2): source files
+# $(3): library dependencies (common); debug prefix is added on as necessary automatically.
+# $(4): library dependencies (target only)
+# $(5): library dependencies (host only)
+# $(6): extra include directories
+# $(7): multilib (default: empty), valid values: {,32,64,both})
+define build-art-multi-executable
+  $(foreach debug_flavor,ndebug debug,
+    $(foreach target_flavor,host target,
+      art-multi-binary-name := $(1)
+      art-multi-source-files := $(2)
+      art-multi-lib-dependencies := $(3)
+      art-multi-lib-dependencies-target := $(4)
+      art-multi-lib-dependencies-host := $(5)
+      art-multi-include-extra := $(6)
+      art-multi-multilib := $(7)
+
+      # Add either -host or -target specific lib dependencies to the lib dependencies.
+      art-multi-lib-dependencies += $$(art-multi-lib-dependencies-$(target_flavor))
+
+      # Replace libart- prefix with libartd- for debug flavor.
+      ifeq ($(debug_flavor),debug)
+        art-multi-lib-dependencies := $$(subst libart-,libartd-,$$(art-multi-lib-dependencies))
+      endif
+
+      # Build the env guard var name, e.g. ART_BUILD_HOST_NDEBUG.
+      art-multi-env-guard := $$(call art-string-to-uppercase,ART_BUILD_$(target_flavor)_$(debug_flavor))
+
+      # Build the art executable only if the corresponding env guard was set.
+      ifeq ($$($$(art-multi-env-guard)),true)
+        $$(eval $$(call build-art-executable,$$(art-multi-binary-name),$$(art-multi-source-files),$$(art-multi-lib-dependencies),$$(art-multi-include-extra),$(target_flavor),$(debug_flavor),$$(art-multi-multilib)))
+      endif
+
+      # Clear locals now they've served their purpose.
+      art-multi-binary-name :=
+      art-multi-source-files :=
+      art-multi-lib-dependencies :=
+      art-multi-lib-dependencies-target :=
+      art-multi-lib-dependencies-host :=
+      art-multi-include-extra :=
+      art-multi-multilib :=
+      art-multi-env-guard :=
+    )
+  )
 endef
diff --git a/build/Android.gtest.mk b/build/Android.gtest.mk
index 5567d15..4c19ba0 100644
--- a/build/Android.gtest.mk
+++ b/build/Android.gtest.mk
@@ -65,10 +65,15 @@ ART_GTEST_elf_writer_test_TARGET_DEPS := $(TARGET_CORE_IMAGE_default_no-pic_64)
 # TODO: document why this is needed.
 ART_GTEST_proxy_test_HOST_DEPS := $(HOST_CORE_IMAGE_default_no-pic_64) $(HOST_CORE_IMAGE_default_no-pic_32)
 
+# The imgdiag test has dependencies on core.oat since it needs to load it during the test.
+ART_GTEST_imgdiag_test_HOST_DEPS := $(HOST_CORE_IMAGE_default_no-pic_64) $(HOST_CORE_IMAGE_default_no-pic_32)
+ART_GTEST_imgdiag_test_TARGET_DEPS := $(TARGET_CORE_IMAGE_default_no-pic_64) $(TARGET_CORE_IMAGE_default_no-pic_32)
+
 # The path for which all the source files are relative, not actually the current directory.
 LOCAL_PATH := art
 
 RUNTIME_GTEST_COMMON_SRC_FILES := \
+  imgdiag/imgdiag_test.cc \
   runtime/arch/arch_test.cc \
   runtime/arch/instruction_set_test.cc \
   runtime/arch/instruction_set_features_test.cc \
diff --git a/cmdline/cmdline.h b/cmdline/cmdline.h
new file mode 100644
index 0000000..c15594a
--- /dev/null
+++ b/cmdline/cmdline.h
@@ -0,0 +1,370 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ART_CMDLINE_CMDLINE_H_
+#define ART_CMDLINE_CMDLINE_H_
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <fstream>
+#include <iostream>
+#include <string>
+
+#include "runtime.h"
+#include "base/stringpiece.h"
+#include "noop_compiler_callbacks.h"
+#include "base/logging.h"
+
+#if !defined(NDEBUG)
+#define DBG_LOG LOG(INFO)
+#else
+#define DBG_LOG LOG(DEBUG)
+#endif
+
+namespace art {
+
+// TODO: Move to <runtime/utils.h> and remove all copies of this function.
+static bool LocationToFilename(const std::string& location, InstructionSet isa,
+                               std::string* filename) {
+  bool has_system = false;
+  bool has_cache = false;
+  // image_location = /system/framework/boot.art
+  // system_image_filename = /system/framework/<image_isa>/boot.art
+  std::string system_filename(GetSystemImageFilename(location.c_str(), isa));
+  if (OS::FileExists(system_filename.c_str())) {
+    has_system = true;
+  }
+
+  bool have_android_data = false;
+  bool dalvik_cache_exists = false;
+  bool is_global_cache = false;
+  std::string dalvik_cache;
+  GetDalvikCache(GetInstructionSetString(isa), false, &dalvik_cache,
+                 &have_android_data, &dalvik_cache_exists, &is_global_cache);
+
+  std::string cache_filename;
+  if (have_android_data && dalvik_cache_exists) {
+    // Always set output location even if it does not exist,
+    // so that the caller knows where to create the image.
+    //
+    // image_location = /system/framework/boot.art
+    // *image_filename = /data/dalvik-cache/<image_isa>/boot.art
+    std::string error_msg;
+    if (GetDalvikCacheFilename(location.c_str(), dalvik_cache.c_str(),
+                               &cache_filename, &error_msg)) {
+      has_cache = true;
+    }
+  }
+  if (has_system) {
+    *filename = system_filename;
+    return true;
+  } else if (has_cache) {
+    *filename = cache_filename;
+    return true;
+  } else {
+    return false;
+  }
+}
+
+static Runtime* StartRuntime(const char* boot_image_location,
+                             InstructionSet instruction_set) {
+  CHECK(boot_image_location != nullptr);
+
+  RuntimeOptions options;
+
+  // We are more like a compiler than a run-time. We don't want to execute code.
+  {
+    static NoopCompilerCallbacks callbacks;
+    options.push_back(std::make_pair("compilercallbacks", &callbacks));
+  }
+
+  // Boot image location.
+  {
+    std::string boot_image_option;
+    boot_image_option += "-Ximage:";
+    boot_image_option += boot_image_location;
+    options.push_back(std::make_pair(boot_image_option.c_str(), nullptr));
+  }
+
+  // Instruction set.
+  options.push_back(
+      std::make_pair("imageinstructionset",
+                     reinterpret_cast<const void*>(GetInstructionSetString(instruction_set))));
+
+  if (!Runtime::Create(options, false)) {
+    fprintf(stderr, "Failed to create runtime\n");
+    return nullptr;
+  }
+
+  // Runtime::Create acquired the mutator_lock_ that is normally given away when we Runtime::Start,
+  // give it away now and then switch to a more manageable ScopedObjectAccess.
+  Thread::Current()->TransitionFromRunnableToSuspended(kNative);
+
+  return Runtime::Current();
+}
+
+struct CmdlineArgs {
+  enum ParseStatus {
+    kParseOk,               // Parse successful. Do not set the error message.
+    kParseUnknownArgument,  // Unknown argument. Do not set the error message.
+    kParseError,            // Parse ok, but failed elsewhere. Print the set error message.
+  };
+
+  bool Parse(int argc, char** argv) {
+    // Skip over argv[0].
+    argv++;
+    argc--;
+
+    if (argc == 0) {
+      fprintf(stderr, "No arguments specified\n");
+      PrintUsage();
+      return false;
+    }
+
+    std::string error_msg;
+    for (int i = 0; i < argc; i++) {
+      const StringPiece option(argv[i]);
+      if (option.starts_with("--boot-image=")) {
+        boot_image_location_ = option.substr(strlen("--boot-image=")).data();
+      } else if (option.starts_with("--instruction-set=")) {
+        StringPiece instruction_set_str = option.substr(strlen("--instruction-set=")).data();
+        instruction_set_ = GetInstructionSetFromString(instruction_set_str.data());
+        if (instruction_set_ == kNone) {
+          fprintf(stderr, "Unsupported instruction set %s\n", instruction_set_str.data());
+          PrintUsage();
+          return false;
+        }
+      } else if (option.starts_with("--output=")) {
+        output_name_ = option.substr(strlen("--output=")).ToString();
+        const char* filename = output_name_.c_str();
+        out_.reset(new std::ofstream(filename));
+        if (!out_->good()) {
+          fprintf(stderr, "Failed to open output filename %s\n", filename);
+          PrintUsage();
+          return false;
+        }
+        os_ = out_.get();
+      } else {
+        ParseStatus parse_status = ParseCustom(option, &error_msg);
+
+        if (parse_status == kParseUnknownArgument) {
+          fprintf(stderr, "Unknown argument %s\n", option.data());
+        }
+
+        if (parse_status != kParseOk) {
+          fprintf(stderr, "%s\n", error_msg.c_str());
+          PrintUsage();
+          return false;
+        }
+      }
+    }
+
+    DBG_LOG << "will call parse checks";
+
+    {
+      ParseStatus checks_status = ParseChecks(&error_msg);
+      if (checks_status != kParseOk) {
+          fprintf(stderr, "%s\n", error_msg.c_str());
+          PrintUsage();
+          return false;
+      }
+    }
+
+    return true;
+  }
+
+  virtual std::string GetUsage() const {
+    std::string usage;
+
+    usage +=  // Required.
+        "  --boot-image=<file.art>: provide the image location for the boot class path.\n"
+        "      Do not include the arch as part of the name, it is added automatically.\n"
+        "      Example: --boot-image=/system/framework/boot.art\n"
+        "\n";
+    usage += StringPrintf(  // Optional.
+        "  --instruction-set=(arm|arm64|mips|x86|x86_64): for locating the image\n"
+        "      file based on the image location set.\n"
+        "      Example: --instruction-set=x86\n"
+        "      Default: %s\n"
+        "\n",
+        GetInstructionSetString(kRuntimeISA));
+    usage +=  // Optional.
+        "  --output=<file> may be used to send the output to a file.\n"
+        "      Example: --output=/tmp/oatdump.txt\n"
+        "\n";
+
+    return usage;
+  }
+
+  // Specified by --boot-image.
+  const char* boot_image_location_ = nullptr;
+  // Specified by --instruction-set.
+  InstructionSet instruction_set_ = kRuntimeISA;
+  // Specified by --output.
+  std::ostream* os_ = &std::cout;
+  std::unique_ptr<std::ofstream> out_;  // If something besides cout is used
+  std::string output_name_;
+
+  virtual ~CmdlineArgs() {}
+
+ protected:
+  virtual ParseStatus ParseCustom(const StringPiece& option, std::string* error_msg) {
+    UNUSED(option);
+    UNUSED(error_msg);
+
+    return kParseUnknownArgument;
+  }
+
+  virtual ParseStatus ParseChecks(std::string* error_msg) {
+    if (boot_image_location_ == nullptr) {
+      *error_msg = "--boot-image must be specified";
+      return kParseError;
+    }
+
+    DBG_LOG << "boot image location: " << boot_image_location_;
+
+    // Checks for --boot-image location.
+    {
+      std::string boot_image_location = boot_image_location_;
+      size_t file_name_idx = boot_image_location.rfind("/");
+      if (file_name_idx == std::string::npos) {  // Prevent a InsertIsaDirectory check failure.
+        *error_msg = "Boot image location must have a / in it";
+        return kParseError;
+      }
+
+      // Don't let image locations with the 'arch' in it through, since it's not a location.
+      // This prevents a common error "Could not create an image space..." when initing the Runtime.
+      if (file_name_idx != std::string::npos) {
+        std::string no_file_name = boot_image_location.substr(0, file_name_idx);
+        size_t ancestor_dirs_idx = no_file_name.rfind("/");
+
+        std::string parent_dir_name;
+        if (ancestor_dirs_idx != std::string::npos) {
+          parent_dir_name = no_file_name.substr(ancestor_dirs_idx + 1);
+        } else {
+          parent_dir_name = no_file_name;
+        }
+
+        DBG_LOG << "boot_image_location parent_dir_name was " << parent_dir_name;
+
+        if (GetInstructionSetFromString(parent_dir_name.c_str()) != kNone) {
+          *error_msg = "Do not specify the architecture as part of the boot image location";
+          return kParseError;
+        }
+      }
+
+      // Check that the boot image location points to a valid file name.
+      std::string file_name;
+      if (!LocationToFilename(boot_image_location, instruction_set_, &file_name)) {
+        *error_msg = StringPrintf("No corresponding file for location '%s' exists",
+                                  file_name.c_str());
+        return kParseError;
+      }
+
+      DBG_LOG << "boot_image_filename does exist: " << file_name;
+    }
+
+    return kParseOk;
+  }
+
+ private:
+  void PrintUsage() {
+    fprintf(stderr, "%s", GetUsage().c_str());
+  }
+};
+
+template <typename Args = CmdlineArgs>
+struct CmdlineMain {
+  int Main(int argc, char** argv) {
+    InitLogging(argv);
+    std::unique_ptr<Args> args = std::unique_ptr<Args>(CreateArguments());
+    args_ = args.get();
+
+    DBG_LOG << "Try to parse";
+
+    if (args_ == nullptr || !args_->Parse(argc, argv)) {
+      return EXIT_FAILURE;
+    }
+
+    std::unique_ptr<Runtime> runtime = CreateRuntime(args.get());
+    if (runtime == nullptr) {
+      return EXIT_FAILURE;
+    }
+
+    bool needs_runtime = NeedsRuntime();
+
+    if (needs_runtime) {
+      if (!ExecuteWithRuntime(runtime.get())) {
+        return EXIT_FAILURE;
+      }
+    } else {
+      if (!ExecuteWithoutRuntime()) {
+        return EXIT_FAILURE;
+      }
+    }
+
+    if (!ExecuteCommon()) {
+      return EXIT_FAILURE;
+    }
+
+    return EXIT_SUCCESS;
+  }
+
+  // Override this function to create your own arguments.
+  // Usually will want to return a subtype of CmdlineArgs.
+  virtual Args* CreateArguments() {
+    return new Args();
+  }
+
+  // Override this function to do something else with the runtime.
+  virtual bool ExecuteWithRuntime(Runtime* runtime) {
+    CHECK(runtime != nullptr);
+    // Do nothing
+    return true;
+  }
+
+  // Does the code execution need a runtime? Sometimes it doesn't.
+  virtual bool NeedsRuntime() {
+    return true;
+  }
+
+  // Do execution without having created a runtime.
+  virtual bool ExecuteWithoutRuntime() {
+    return true;
+  }
+
+  // Continue execution after ExecuteWith[out]Runtime
+  virtual bool ExecuteCommon() {
+    return true;
+  }
+
+  virtual ~CmdlineMain() {}
+
+ protected:
+  Args* args_ = nullptr;
+
+ private:
+  std::unique_ptr<Runtime> CreateRuntime(CmdlineArgs* args) {
+    CHECK(args != nullptr);
+
+    return std::unique_ptr<Runtime>(StartRuntime(args->boot_image_location_,
+                                                 args->instruction_set_));
+  }
+};
+}  // namespace art
+
+#endif  // ART_CMDLINE_CMDLINE_H_
diff --git a/compiler/elf_writer_test.cc b/compiler/elf_writer_test.cc
index 7fabc30..fd3a912 100644
--- a/compiler/elf_writer_test.cc
+++ b/compiler/elf_writer_test.cc
@@ -51,14 +51,7 @@ TEST_F(ElfWriterTest, DISABLED_dlsym) {
 #else
 TEST_F(ElfWriterTest, dlsym) {
 #endif
-  std::string elf_location;
-  if (IsHost()) {
-    const char* host_dir = getenv("ANDROID_HOST_OUT");
-    CHECK(host_dir != NULL);
-    elf_location = StringPrintf("%s/framework/core.oat", host_dir);
-  } else {
-    elf_location = "/data/art-test/core.oat";
-  }
+  std::string elf_location = GetCoreOatLocation();
   std::string elf_filename = GetSystemImageFilename(elf_location.c_str(), kRuntimeISA);
   LOG(INFO) << "elf_filename=" << elf_filename;
 
diff --git a/imgdiag/Android.mk b/imgdiag/Android.mk
new file mode 100644
index 0000000..d5d7c22
--- /dev/null
+++ b/imgdiag/Android.mk
@@ -0,0 +1,28 @@
+#
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include art/build/Android.executable.mk
+
+IMGDIAG_SRC_FILES := \
+	imgdiag.cc
+
+# Note that this tool needs to be built for both 32-bit and 64-bit since it requires
+# that the image it's analyzing be the same ISA as the runtime ISA.
+
+# Build variants {target,host} x {debug,ndebug} x {32,64}
+$(eval $(call build-art-multi-executable,imgdiag,$(IMGDIAG_SRC_FILES),libart-compiler libbacktrace,libcutils,libziparchive-host,art/compiler,both))
diff --git a/imgdiag/imgdiag.cc b/imgdiag/imgdiag.cc
new file mode 100644
index 0000000..9b57ecb
--- /dev/null
+++ b/imgdiag/imgdiag.cc
@@ -0,0 +1,951 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <fstream>
+#include <iostream>
+#include <string>
+#include <vector>
+#include <set>
+#include <map>
+
+#include "base/unix_file/fd_file.h"
+#include "base/stringprintf.h"
+#include "gc/space/image_space.h"
+#include "gc/heap.h"
+#include "mirror/class-inl.h"
+#include "mirror/object-inl.h"
+#include "mirror/art_method-inl.h"
+#include "image.h"
+#include "scoped_thread_state_change.h"
+#include "os.h"
+#include "gc_map.h"
+
+#include "cmdline.h"
+#include "backtrace/BacktraceMap.h"
+
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <signal.h>
+
+namespace art {
+
+class ImgDiagDumper {
+ public:
+  explicit ImgDiagDumper(std::ostream* os,
+                       const ImageHeader& image_header,
+                       const char* image_location,
+                       pid_t image_diff_pid)
+      : os_(os),
+        image_header_(image_header),
+        image_location_(image_location),
+        image_diff_pid_(image_diff_pid) {}
+
+  bool Dump() SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
+    std::ostream& os = *os_;
+    os << "MAGIC: " << image_header_.GetMagic() << "\n\n";
+
+    os << "IMAGE BEGIN: " << reinterpret_cast<void*>(image_header_.GetImageBegin()) << "\n\n";
+
+    bool ret = true;
+    if (image_diff_pid_ >= 0) {
+      os << "IMAGE DIFF PID (" << image_diff_pid_ << "): ";
+      ret = DumpImageDiff(image_diff_pid_);
+      os << "\n\n";
+    } else {
+      os << "IMAGE DIFF PID: disabled\n\n";
+    }
+
+    os << std::flush;
+
+    return ret;
+  }
+
+ private:
+  static bool EndsWith(const std::string& str, const std::string& suffix) {
+    return str.size() >= suffix.size() &&
+           str.compare(str.size() - suffix.size(), suffix.size(), suffix) == 0;
+  }
+
+  // Return suffix of the file path after the last /. (e.g. /foo/bar -> bar, bar -> bar)
+  static std::string BaseName(const std::string& str) {
+    size_t idx = str.rfind("/");
+    if (idx == std::string::npos) {
+      return str;
+    }
+
+    return str.substr(idx + 1);
+  }
+
+  bool DumpImageDiff(pid_t image_diff_pid) SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
+    std::ostream& os = *os_;
+
+    {
+      struct stat sts;
+      std::string proc_pid_str = StringPrintf("/proc/%ld", static_cast<long>(image_diff_pid));  // NOLINT [runtime/int]
+      if (stat(proc_pid_str.c_str(), &sts) == -1) {
+        os << "Process does not exist";
+        return false;
+      }
+    }
+
+    // Open /proc/$pid/maps to view memory maps
+    auto proc_maps = std::unique_ptr<BacktraceMap>(BacktraceMap::Create(image_diff_pid));
+    if (proc_maps == nullptr) {
+      os << "Could not read backtrace maps";
+      return false;
+    }
+
+    bool found_boot_map = false;
+    backtrace_map_t boot_map = backtrace_map_t();
+    // Find the memory map only for boot.art
+    for (const backtrace_map_t& map : *proc_maps) {
+      if (EndsWith(map.name, GetImageLocationBaseName())) {
+        if ((map.flags & PROT_WRITE) != 0) {
+          boot_map = map;
+          found_boot_map = true;
+          break;
+        }
+        // In actuality there's more than 1 map, but the second one is read-only.
+        // The one we care about is the write-able map.
+        // The readonly maps are guaranteed to be identical, so its not interesting to compare
+        // them.
+      }
+    }
+
+    if (!found_boot_map) {
+      os << "Could not find map for " << GetImageLocationBaseName();
+      return false;
+    }
+
+    // Future idea: diff against zygote so we can ignore the shared dirty pages.
+    return DumpImageDiffMap(image_diff_pid, boot_map);
+  }
+
+    // Look at /proc/$pid/mem and only diff the things from there
+  bool DumpImageDiffMap(pid_t image_diff_pid, const backtrace_map_t& boot_map)
+    SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
+    std::ostream& os = *os_;
+    const size_t pointer_size = InstructionSetPointerSize(
+        Runtime::Current()->GetInstructionSet());
+
+    std::string file_name = StringPrintf("/proc/%ld/mem", static_cast<long>(image_diff_pid));  // NOLINT [runtime/int]
+
+    size_t boot_map_size = boot_map.end - boot_map.start;
+
+    // Open /proc/$pid/mem as a file
+    auto map_file = std::unique_ptr<File>(OS::OpenFileForReading(file_name.c_str()));
+    if (map_file == nullptr) {
+      os << "Failed to open " << file_name << " for reading";
+      return false;
+    }
+
+    // Memory-map /proc/$pid/mem subset from the boot map
+    CHECK(boot_map.end >= boot_map.start);
+
+    std::string error_msg;
+
+    // Walk the bytes and diff against our boot image
+    const ImageHeader& boot_image_header = GetBootImageHeader();
+
+    os << "\nObserving boot image header at address "
+       << reinterpret_cast<const void*>(&boot_image_header)
+       << "\n\n";
+
+    const uint8_t* image_begin_unaligned = boot_image_header.GetImageBegin();
+    const uint8_t* image_end_unaligned = image_begin_unaligned + boot_image_header.GetImageSize();
+
+    // Adjust range to nearest page
+    const uint8_t* image_begin = AlignDown(image_begin_unaligned, kPageSize);
+    const uint8_t* image_end = AlignUp(image_end_unaligned, kPageSize);
+
+    ptrdiff_t page_off_begin = boot_image_header.GetImageBegin() - image_begin;
+
+    if (reinterpret_cast<uintptr_t>(image_begin) > boot_map.start ||
+        reinterpret_cast<uintptr_t>(image_end) < boot_map.end) {
+      // Sanity check that we aren't trying to read a completely different boot image
+      os << "Remote boot map is out of range of local boot map: " <<
+        "local begin " << reinterpret_cast<const void*>(image_begin) <<
+        ", local end " << reinterpret_cast<const void*>(image_end) <<
+        ", remote begin " << reinterpret_cast<const void*>(boot_map.start) <<
+        ", remote end " << reinterpret_cast<const void*>(boot_map.end);
+      return false;
+      // If we wanted even more validation we could map the ImageHeader from the file
+    }
+
+    std::vector<uint8_t> remote_contents(boot_map_size);
+    if (!map_file->PreadFully(&remote_contents[0], boot_map_size, boot_map.start)) {
+      os << "Could not fully read file " << file_name;
+      return false;
+    }
+
+    std::string page_map_file_name = StringPrintf("/proc/%ld/pagemap",
+                                                  static_cast<long>(image_diff_pid));  // NOLINT [runtime/int]
+    auto page_map_file = std::unique_ptr<File>(OS::OpenFileForReading(page_map_file_name.c_str()));
+    if (page_map_file == nullptr) {
+      os << "Failed to open " << page_map_file_name << " for reading: " << strerror(errno);
+      return false;
+    }
+
+    // Not truly clean, mmap-ing boot.art again would be more pristine, but close enough
+    const char* clean_page_map_file_name = "/proc/self/pagemap";
+    auto clean_page_map_file = std::unique_ptr<File>(
+        OS::OpenFileForReading(clean_page_map_file_name));
+    if (clean_page_map_file == nullptr) {
+      os << "Failed to open " << clean_page_map_file_name << " for reading: " << strerror(errno);
+      return false;
+    }
+
+    auto kpage_flags_file = std::unique_ptr<File>(OS::OpenFileForReading("/proc/kpageflags"));
+    if (kpage_flags_file == nullptr) {
+      os << "Failed to open /proc/kpageflags for reading: " << strerror(errno);
+      return false;
+    }
+
+    auto kpage_count_file = std::unique_ptr<File>(OS::OpenFileForReading("/proc/kpagecount"));
+    if (kpage_count_file == nullptr) {
+      os << "Failed to open /proc/kpagecount for reading:" << strerror(errno);
+      return false;
+    }
+
+    std::set<size_t> dirty_page_set_remote;  // Set of the remote virtual page indices that are dirty
+    std::set<size_t> dirty_page_set_local;   // Set of the local virtual page indices that are dirty
+
+    size_t different_int32s = 0;
+    size_t different_bytes = 0;
+    size_t different_pages = 0;
+    size_t virtual_page_idx = 0;   // Virtual page number (for an absolute memory address)
+    size_t page_idx = 0;           // Page index relative to 0
+    size_t previous_page_idx = 0;  // Previous page index relative to 0
+    size_t dirty_pages = 0;
+    size_t private_pages = 0;
+    size_t private_dirty_pages = 0;
+
+    // Iterate through one page at a time. Boot map begin/end already implicitly aligned.
+    for (uintptr_t begin = boot_map.start; begin != boot_map.end; begin += kPageSize) {
+      ptrdiff_t offset = begin - boot_map.start;
+
+      // We treat the image header as part of the memory map for now
+      // If we wanted to change this, we could pass base=start+sizeof(ImageHeader)
+      // But it might still be interesting to see if any of the ImageHeader data mutated
+      const uint8_t* local_ptr = reinterpret_cast<const uint8_t*>(&boot_image_header) + offset;
+      uint8_t* remote_ptr = &remote_contents[offset];
+
+      if (memcmp(local_ptr, remote_ptr, kPageSize) != 0) {
+        different_pages++;
+
+        // Count the number of 32-bit integers that are different.
+        for (size_t i = 0; i < kPageSize / sizeof(uint32_t); ++i) {
+          uint32_t* remote_ptr_int32 = reinterpret_cast<uint32_t*>(remote_ptr);
+          const uint32_t* local_ptr_int32 = reinterpret_cast<const uint32_t*>(local_ptr);
+
+          if (remote_ptr_int32[i] != local_ptr_int32[i]) {
+            different_int32s++;
+          }
+        }
+      }
+    }
+
+    // Iterate through one byte at a time.
+    for (uintptr_t begin = boot_map.start; begin != boot_map.end; ++begin) {
+      previous_page_idx = page_idx;
+      ptrdiff_t offset = begin - boot_map.start;
+
+      // We treat the image header as part of the memory map for now
+      // If we wanted to change this, we could pass base=start+sizeof(ImageHeader)
+      // But it might still be interesting to see if any of the ImageHeader data mutated
+      const uint8_t* local_ptr = reinterpret_cast<const uint8_t*>(&boot_image_header) + offset;
+      uint8_t* remote_ptr = &remote_contents[offset];
+
+      virtual_page_idx = reinterpret_cast<uintptr_t>(local_ptr) / kPageSize;
+
+      // Calculate the page index, relative to the 0th page where the image begins
+      page_idx = (offset + page_off_begin) / kPageSize;
+      if (*local_ptr != *remote_ptr) {
+        // Track number of bytes that are different
+        different_bytes++;
+      }
+
+      // Independently count the # of dirty pages on the remote side
+      size_t remote_virtual_page_idx = begin / kPageSize;
+      if (previous_page_idx != page_idx) {
+        uint64_t page_count = 0xC0FFEE;
+        // TODO: virtual_page_idx needs to be from the same process
+        int dirtiness = (IsPageDirty(page_map_file.get(),        // Image-diff-pid procmap
+                                     clean_page_map_file.get(),  // Self procmap
+                                     kpage_flags_file.get(),
+                                     kpage_count_file.get(),
+                                     remote_virtual_page_idx,    // potentially "dirty" page
+                                     virtual_page_idx,           // true "clean" page
+                                     &page_count,
+                                     &error_msg));
+        if (dirtiness < 0) {
+          os << error_msg;
+          return false;
+        } else if (dirtiness > 0) {
+          dirty_pages++;
+          dirty_page_set_remote.insert(dirty_page_set_remote.end(), remote_virtual_page_idx);
+          dirty_page_set_local.insert(dirty_page_set_local.end(), virtual_page_idx);
+        }
+
+        bool is_dirty = dirtiness > 0;
+        bool is_private = page_count == 1;
+
+        if (page_count == 1) {
+          private_pages++;
+        }
+
+        if (is_dirty && is_private) {
+          private_dirty_pages++;
+        }
+      }
+    }
+
+    // Walk each object in the remote image space and compare it against ours
+    size_t different_objects = 0;
+    std::map<mirror::Class*, int /*count*/> dirty_object_class_map;
+    // Track only the byte-per-byte dirtiness (in bytes)
+    std::map<mirror::Class*, int /*byte_count*/> dirty_object_byte_count;
+    // Track the object-by-object dirtiness (in bytes)
+    std::map<mirror::Class*, int /*byte_count*/> dirty_object_size_in_bytes;
+    std::map<mirror::Class*, int /*count*/> clean_object_class_map;
+
+    std::map<mirror::Class*, std::string> class_to_descriptor_map;
+
+    std::map<off_t /* field offset */, int /* count */> art_method_field_dirty_count;
+    std::vector<mirror::ArtMethod*> art_method_dirty_objects;
+
+    std::map<off_t /* field offset */, int /* count */> class_field_dirty_count;
+    std::vector<mirror::Class*> class_dirty_objects;
+
+    // List of local objects that are clean, but located on dirty pages.
+    std::vector<mirror::Object*> false_dirty_objects;
+    std::map<mirror::Class*, int /*byte_count*/> false_dirty_byte_count;
+    std::map<mirror::Class*, int /*object_count*/> false_dirty_object_count;
+    std::map<mirror::Class*, std::vector<mirror::Object*>> false_dirty_objects_map;
+    size_t false_dirty_object_bytes = 0;
+
+    // Remote pointers to dirty objects
+    std::map<mirror::Class*, std::vector<mirror::Object*>> dirty_objects_by_class;
+    // Look up remote classes by their descriptor
+    std::map<std::string, mirror::Class*> remote_class_map;
+    // Look up local classes by their descriptor
+    std::map<std::string, mirror::Class*> local_class_map;
+
+    size_t dirty_object_bytes = 0;
+    {
+      const uint8_t* begin_image_ptr = image_begin_unaligned;
+      const uint8_t* end_image_ptr = image_end_unaligned;
+
+      const uint8_t* current = begin_image_ptr + RoundUp(sizeof(ImageHeader), kObjectAlignment);
+      while (reinterpret_cast<const uintptr_t>(current)
+             < reinterpret_cast<const uintptr_t>(end_image_ptr)) {
+        CHECK_ALIGNED(current, kObjectAlignment);
+        mirror::Object* obj = reinterpret_cast<mirror::Object*>(const_cast<uint8_t*>(current));
+
+        // Sanity check that we are reading a real object
+        CHECK(obj->GetClass() != nullptr) << "Image object at address " << obj << " has null class";
+        if (kUseBakerOrBrooksReadBarrier) {
+          obj->AssertReadBarrierPointer();
+        }
+
+        // Iterate every page this object belongs to
+        bool on_dirty_page = false;
+        size_t page_off = 0;
+        size_t current_page_idx;
+        uintptr_t object_address;
+        do {
+          object_address = reinterpret_cast<uintptr_t>(current);
+          current_page_idx = object_address / kPageSize + page_off;
+
+          if (dirty_page_set_local.find(current_page_idx) != dirty_page_set_local.end()) {
+            // This object is on a dirty page
+            on_dirty_page = true;
+          }
+
+          page_off++;
+        } while ((current_page_idx * kPageSize) <
+                 RoundUp(object_address + obj->SizeOf(), kObjectAlignment));
+
+        mirror::Class* klass = obj->GetClass();
+
+        bool different_object = false;
+
+        // Check against the other object and see if they are different
+        ptrdiff_t offset = current - begin_image_ptr;
+        const uint8_t* current_remote = &remote_contents[offset];
+        mirror::Object* remote_obj = reinterpret_cast<mirror::Object*>(
+            const_cast<uint8_t*>(current_remote));
+        if (memcmp(current, current_remote, obj->SizeOf()) != 0) {
+          different_objects++;
+          dirty_object_bytes += obj->SizeOf();
+
+          ++dirty_object_class_map[klass];
+
+          // Go byte-by-byte and figure out what exactly got dirtied
+          size_t dirty_byte_count_per_object = 0;
+          for (size_t i = 0; i < obj->SizeOf(); ++i) {
+            if (current[i] != current_remote[i]) {
+              dirty_byte_count_per_object++;
+            }
+          }
+          dirty_object_byte_count[klass] += dirty_byte_count_per_object;
+          dirty_object_size_in_bytes[klass] += obj->SizeOf();
+
+          different_object = true;
+
+          dirty_objects_by_class[klass].push_back(remote_obj);
+        } else {
+          ++clean_object_class_map[klass];
+        }
+
+        std::string descriptor = GetClassDescriptor(klass);
+        if (different_object) {
+          if (strcmp(descriptor.c_str(), "Ljava/lang/Class;") == 0) {
+            // this is a "Class"
+            mirror::Class* obj_as_class  = reinterpret_cast<mirror::Class*>(remote_obj);
+
+            // print the fields that are dirty
+            for (size_t i = 0; i < obj->SizeOf(); ++i) {
+              if (current[i] != current_remote[i]) {
+                class_field_dirty_count[i]++;
+              }
+            }
+
+            class_dirty_objects.push_back(obj_as_class);
+          } else if (strcmp(descriptor.c_str(), "Ljava/lang/reflect/ArtMethod;") == 0) {
+            // this is an ArtMethod
+            mirror::ArtMethod* art_method = reinterpret_cast<mirror::ArtMethod*>(remote_obj);
+
+            // print the fields that are dirty
+            for (size_t i = 0; i < obj->SizeOf(); ++i) {
+              if (current[i] != current_remote[i]) {
+                art_method_field_dirty_count[i]++;
+              }
+            }
+
+            art_method_dirty_objects.push_back(art_method);
+          }
+        } else if (on_dirty_page) {
+          // This object was either never mutated or got mutated back to the same value.
+          // TODO: Do I want to distinguish a "different" vs a "dirty" page here?
+          false_dirty_objects.push_back(obj);
+          false_dirty_objects_map[klass].push_back(obj);
+          false_dirty_object_bytes += obj->SizeOf();
+          false_dirty_byte_count[obj->GetClass()] += obj->SizeOf();
+          false_dirty_object_count[obj->GetClass()] += 1;
+        }
+
+        if (strcmp(descriptor.c_str(), "Ljava/lang/Class;") == 0) {
+          local_class_map[descriptor] = reinterpret_cast<mirror::Class*>(obj);
+          remote_class_map[descriptor] = reinterpret_cast<mirror::Class*>(remote_obj);
+        }
+
+        // Unconditionally store the class descriptor in case we need it later
+        class_to_descriptor_map[klass] = descriptor;
+        current += RoundUp(obj->SizeOf(), kObjectAlignment);
+      }
+    }
+
+    // Looking at only dirty pages, figure out how many of those bytes belong to dirty objects.
+    float true_dirtied_percent = dirty_object_bytes * 1.0f / (dirty_pages * kPageSize);
+    size_t false_dirty_pages = dirty_pages - different_pages;
+
+    os << "Mapping at [" << reinterpret_cast<void*>(boot_map.start) << ", "
+       << reinterpret_cast<void*>(boot_map.end) << ") had: \n  "
+       << different_bytes << " differing bytes, \n  "
+       << different_int32s << " differing int32s, \n  "
+       << different_objects << " different objects, \n  "
+       << dirty_object_bytes << " different object [bytes], \n  "
+       << false_dirty_objects.size() << " false dirty objects,\n  "
+       << false_dirty_object_bytes << " false dirty object [bytes], \n  "
+       << true_dirtied_percent << " different objects-vs-total in a dirty page;\n  "
+       << different_pages << " different pages; \n  "
+       << dirty_pages << " pages are dirty; \n  "
+       << false_dirty_pages << " pages are false dirty; \n  "
+       << private_pages << " pages are private; \n  "
+       << private_dirty_pages << " pages are Private_Dirty\n  "
+       << "";
+
+    // vector of pairs (int count, Class*)
+    auto dirty_object_class_values = SortByValueDesc(dirty_object_class_map);
+    auto clean_object_class_values = SortByValueDesc(clean_object_class_map);
+
+    os << "\n" << "  Dirty object count by class:\n";
+    for (const auto& vk_pair : dirty_object_class_values) {
+      int dirty_object_count = vk_pair.first;
+      mirror::Class* klass = vk_pair.second;
+      int object_sizes = dirty_object_size_in_bytes[klass];
+      float avg_dirty_bytes_per_class = dirty_object_byte_count[klass] * 1.0f / object_sizes;
+      float avg_object_size = object_sizes * 1.0f / dirty_object_count;
+      const std::string& descriptor = class_to_descriptor_map[klass];
+      os << "    " << PrettyClass(klass) << " ("
+         << "objects: " << dirty_object_count << ", "
+         << "avg dirty bytes: " << avg_dirty_bytes_per_class << ", "
+         << "avg object size: " << avg_object_size << ", "
+         << "class descriptor: '" << descriptor << "'"
+         << ")\n";
+
+      constexpr size_t kMaxAddressPrint = 5;
+      if (strcmp(descriptor.c_str(), "Ljava/lang/reflect/ArtMethod;") == 0) {
+        os << "      sample object addresses: ";
+        for (size_t i = 0; i < art_method_dirty_objects.size() && i < kMaxAddressPrint; ++i) {
+          auto art_method = art_method_dirty_objects[i];
+
+          os << reinterpret_cast<void*>(art_method) << ", ";
+        }
+        os << "\n";
+
+        os << "      dirty byte +offset:count list = ";
+        auto art_method_field_dirty_count_sorted = SortByValueDesc(art_method_field_dirty_count);
+        for (auto pair : art_method_field_dirty_count_sorted) {
+          off_t offset = pair.second;
+          int count = pair.first;
+
+          os << "+" << offset << ":" << count << ", ";
+        }
+
+        os << "\n";
+
+        os << "      field contents:\n";
+        const auto& dirty_objects_list = dirty_objects_by_class[klass];
+        for (mirror::Object* obj : dirty_objects_list) {
+          // remote method
+          auto art_method = reinterpret_cast<mirror::ArtMethod*>(obj);
+
+          // remote class
+          mirror::Class* remote_declaring_class =
+            FixUpRemotePointer(art_method->GetDeclaringClass(), remote_contents, boot_map);
+
+          // local class
+          mirror::Class* declaring_class =
+            RemoteContentsPointerToLocal(remote_declaring_class,
+                                         remote_contents,
+                                         boot_image_header);
+
+          os << "        " << reinterpret_cast<void*>(obj) << " ";
+          os << "  entryPointFromJni: "
+             << reinterpret_cast<const void*>(
+                    art_method->GetEntryPointFromJniPtrSize(pointer_size)) << ", ";
+          os << "  entryPointFromInterpreter: "
+             << reinterpret_cast<const void*>(
+                    art_method->GetEntryPointFromInterpreterPtrSize<kVerifyNone>(pointer_size))
+             << ", ";
+          os << "  entryPointFromQuickCompiledCode: "
+             << reinterpret_cast<const void*>(
+                    art_method->GetEntryPointFromQuickCompiledCodePtrSize(pointer_size))
+             << ", ";
+          os << "  isNative? " << (art_method->IsNative() ? "yes" : "no") << ", ";
+          os << "  class_status (local): " << declaring_class->GetStatus();
+          os << "  class_status (remote): " << remote_declaring_class->GetStatus();
+          os << "\n";
+        }
+      }
+      if (strcmp(descriptor.c_str(), "Ljava/lang/Class;") == 0) {
+        os << "       sample object addresses: ";
+        for (size_t i = 0; i < class_dirty_objects.size() && i < kMaxAddressPrint; ++i) {
+          auto class_ptr = class_dirty_objects[i];
+
+          os << reinterpret_cast<void*>(class_ptr) << ", ";
+        }
+        os << "\n";
+
+        os << "       dirty byte +offset:count list = ";
+        auto class_field_dirty_count_sorted = SortByValueDesc(class_field_dirty_count);
+        for (auto pair : class_field_dirty_count_sorted) {
+          off_t offset = pair.second;
+          int count = pair.first;
+
+          os << "+" << offset << ":" << count << ", ";
+        }
+        os << "\n";
+
+        os << "      field contents:\n";
+        const auto& dirty_objects_list = dirty_objects_by_class[klass];
+        for (mirror::Object* obj : dirty_objects_list) {
+          // remote class object
+          auto remote_klass = reinterpret_cast<mirror::Class*>(obj);
+
+          // local class object
+          auto local_klass = RemoteContentsPointerToLocal(remote_klass,
+                                                          remote_contents,
+                                                          boot_image_header);
+
+          os << "        " << reinterpret_cast<void*>(obj) << " ";
+          os << "  class_status (remote): " << remote_klass->GetStatus() << ", ";
+          os << "  class_status (local): " << local_klass->GetStatus();
+          os << "\n";
+        }
+      }
+    }
+
+    auto false_dirty_object_class_values = SortByValueDesc(false_dirty_object_count);
+
+    os << "\n" << "  False-dirty object count by class:\n";
+    for (const auto& vk_pair : false_dirty_object_class_values) {
+      int object_count = vk_pair.first;
+      mirror::Class* klass = vk_pair.second;
+      int object_sizes = false_dirty_byte_count[klass];
+      float avg_object_size = object_sizes * 1.0f / object_count;
+      const std::string& descriptor = class_to_descriptor_map[klass];
+      os << "    " << PrettyClass(klass) << " ("
+         << "objects: " << object_count << ", "
+         << "avg object size: " << avg_object_size << ", "
+         << "total bytes: " << object_sizes << ", "
+         << "class descriptor: '" << descriptor << "'"
+         << ")\n";
+
+      if (strcmp(descriptor.c_str(), "Ljava/lang/reflect/ArtMethod;") == 0) {
+        auto& art_method_false_dirty_objects = false_dirty_objects_map[klass];
+
+        os << "      field contents:\n";
+        for (mirror::Object* obj : art_method_false_dirty_objects) {
+          // local method
+          auto art_method = reinterpret_cast<mirror::ArtMethod*>(obj);
+
+          // local class
+          mirror::Class* declaring_class = art_method->GetDeclaringClass();
+
+          os << "        " << reinterpret_cast<void*>(obj) << " ";
+          os << "  entryPointFromJni: "
+             << reinterpret_cast<const void*>(
+                    art_method->GetEntryPointFromJniPtrSize(pointer_size)) << ", ";
+          os << "  entryPointFromInterpreter: "
+             << reinterpret_cast<const void*>(
+                    art_method->GetEntryPointFromInterpreterPtrSize<kVerifyNone>(pointer_size))
+             << ", ";
+          os << "  entryPointFromQuickCompiledCode: "
+             << reinterpret_cast<const void*>(
+                    art_method->GetEntryPointFromQuickCompiledCodePtrSize(pointer_size))
+             << ", ";
+          os << "  isNative? " << (art_method->IsNative() ? "yes" : "no") << ", ";
+          os << "  class_status (local): " << declaring_class->GetStatus();
+          os << "\n";
+        }
+      }
+    }
+
+    os << "\n" << "  Clean object count by class:\n";
+    for (const auto& vk_pair : clean_object_class_values) {
+      os << "    " << PrettyClass(vk_pair.second) << " (" << vk_pair.first << ")\n";
+    }
+
+    return true;
+  }
+
+  // Fixup a remote pointer that we read from a foreign boot.art to point to our own memory.
+  // Returned pointer will point to inside of remote_contents.
+  template <typename T>
+  static T* FixUpRemotePointer(T* remote_ptr,
+                               std::vector<uint8_t>& remote_contents,
+                               const backtrace_map_t& boot_map) {
+    if (remote_ptr == nullptr) {
+      return nullptr;
+    }
+
+    uintptr_t remote = reinterpret_cast<uintptr_t>(remote_ptr);
+
+    CHECK_LE(boot_map.start, remote);
+    CHECK_GT(boot_map.end, remote);
+
+    off_t boot_offset = remote - boot_map.start;
+
+    return reinterpret_cast<T*>(&remote_contents[boot_offset]);
+  }
+
+  template <typename T>
+  static T* RemoteContentsPointerToLocal(T* remote_ptr,
+                                         std::vector<uint8_t>& remote_contents,
+                                         const ImageHeader& image_header) {
+    if (remote_ptr == nullptr) {
+      return nullptr;
+    }
+
+    uint8_t* remote = reinterpret_cast<uint8_t*>(remote_ptr);
+    ptrdiff_t boot_offset = remote - &remote_contents[0];
+
+    const uint8_t* local_ptr = reinterpret_cast<const uint8_t*>(&image_header) + boot_offset;
+
+    return reinterpret_cast<T*>(const_cast<uint8_t*>(local_ptr));
+  }
+
+  static std::string GetClassDescriptor(mirror::Class* klass)
+    SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
+    CHECK(klass != nullptr);
+
+    std::string descriptor;
+    const char* descriptor_str = klass->GetDescriptor(&descriptor);
+
+    return std::string(descriptor_str);
+  }
+
+  template <typename K, typename V>
+  static std::vector<std::pair<V, K>> SortByValueDesc(const std::map<K, V> map) {
+    // Store value->key so that we can use the default sort from pair which
+    // sorts by value first and then key
+    std::vector<std::pair<V, K>> value_key_vector;
+
+    for (const auto& kv_pair : map) {
+      value_key_vector.push_back(std::make_pair(kv_pair.second, kv_pair.first));
+    }
+
+    // Sort in reverse (descending order)
+    std::sort(value_key_vector.rbegin(), value_key_vector.rend());
+    return value_key_vector;
+  }
+
+  static bool GetPageFrameNumber(File* page_map_file,
+                                size_t virtual_page_index,
+                                uint64_t* page_frame_number,
+                                std::string* error_msg) {
+    CHECK(page_map_file != nullptr);
+    CHECK(page_frame_number != nullptr);
+    CHECK(error_msg != nullptr);
+
+    constexpr size_t kPageMapEntrySize = sizeof(uint64_t);
+    constexpr uint64_t kPageFrameNumberMask = (1ULL << 55) - 1;  // bits 0-54 [in /proc/$pid/pagemap]
+    constexpr uint64_t kPageSoftDirtyMask = (1ULL << 55);  // bit 55 [in /proc/$pid/pagemap]
+
+    uint64_t page_map_entry = 0;
+
+    // Read 64-bit entry from /proc/$pid/pagemap to get the physical page frame number
+    if (!page_map_file->PreadFully(&page_map_entry, kPageMapEntrySize,
+                                  virtual_page_index * kPageMapEntrySize)) {
+      *error_msg = StringPrintf("Failed to read the virtual page index entry from %s",
+                                page_map_file->GetPath().c_str());
+      return false;
+    }
+
+    // TODO: seems useless, remove this.
+    bool soft_dirty = (page_map_entry & kPageSoftDirtyMask) != 0;
+    if ((false)) {
+      LOG(VERBOSE) << soft_dirty;  // Suppress unused warning
+      UNREACHABLE();
+    }
+
+    *page_frame_number = page_map_entry & kPageFrameNumberMask;
+
+    return true;
+  }
+
+  static int IsPageDirty(File* page_map_file,
+                         File* clean_page_map_file,
+                         File* kpage_flags_file,
+                         File* kpage_count_file,
+                         size_t virtual_page_idx,
+                         size_t clean_virtual_page_idx,
+                         // Out parameters:
+                         uint64_t* page_count, std::string* error_msg) {
+    CHECK(page_map_file != nullptr);
+    CHECK(clean_page_map_file != nullptr);
+    CHECK_NE(page_map_file, clean_page_map_file);
+    CHECK(kpage_flags_file != nullptr);
+    CHECK(kpage_count_file != nullptr);
+    CHECK(page_count != nullptr);
+    CHECK(error_msg != nullptr);
+
+    // Constants are from https://www.kernel.org/doc/Documentation/vm/pagemap.txt
+
+    constexpr size_t kPageFlagsEntrySize = sizeof(uint64_t);
+    constexpr size_t kPageCountEntrySize = sizeof(uint64_t);
+    constexpr uint64_t kPageFlagsDirtyMask = (1ULL << 4);  // in /proc/kpageflags
+    constexpr uint64_t kPageFlagsNoPageMask = (1ULL << 20);  // in /proc/kpageflags
+    constexpr uint64_t kPageFlagsMmapMask = (1ULL << 11);  // in /proc/kpageflags
+
+    uint64_t page_frame_number = 0;
+    if (!GetPageFrameNumber(page_map_file, virtual_page_idx, &page_frame_number, error_msg)) {
+      return -1;
+    }
+
+    uint64_t page_frame_number_clean = 0;
+    if (!GetPageFrameNumber(clean_page_map_file, clean_virtual_page_idx, &page_frame_number_clean,
+                            error_msg)) {
+      return -1;
+    }
+
+    // Read 64-bit entry from /proc/kpageflags to get the dirty bit for a page
+    uint64_t kpage_flags_entry = 0;
+    if (!kpage_flags_file->PreadFully(&kpage_flags_entry,
+                                     kPageFlagsEntrySize,
+                                     page_frame_number * kPageFlagsEntrySize)) {
+      *error_msg = StringPrintf("Failed to read the page flags from %s",
+                                kpage_flags_file->GetPath().c_str());
+      return -1;
+    }
+
+    // Read 64-bit entyry from /proc/kpagecount to get mapping counts for a page
+    if (!kpage_count_file->PreadFully(page_count /*out*/,
+                                     kPageCountEntrySize,
+                                     page_frame_number * kPageCountEntrySize)) {
+      *error_msg = StringPrintf("Failed to read the page count from %s",
+                                kpage_count_file->GetPath().c_str());
+      return -1;
+    }
+
+    // There must be a page frame at the requested address.
+    CHECK_EQ(kpage_flags_entry & kPageFlagsNoPageMask, 0u);
+    // The page frame must be memory mapped
+    CHECK_NE(kpage_flags_entry & kPageFlagsMmapMask, 0u);
+
+    // Page is dirty, i.e. has diverged from file, if the 4th bit is set to 1
+    bool flags_dirty = (kpage_flags_entry & kPageFlagsDirtyMask) != 0;
+
+    // page_frame_number_clean must come from the *same* process
+    // but a *different* mmap than page_frame_number
+    if (flags_dirty) {
+      CHECK_NE(page_frame_number, page_frame_number_clean);
+    }
+
+    return page_frame_number != page_frame_number_clean;
+  }
+
+  static const ImageHeader& GetBootImageHeader() {
+    gc::Heap* heap = Runtime::Current()->GetHeap();
+    gc::space::ImageSpace* image_space = heap->GetImageSpace();
+    CHECK(image_space != nullptr);
+    const ImageHeader& image_header = image_space->GetImageHeader();
+    return image_header;
+  }
+
+ private:
+  // Return the image location, stripped of any directories, e.g. "boot.art" or "core.art"
+  std::string GetImageLocationBaseName() const {
+    return BaseName(std::string(image_location_));
+  }
+
+  std::ostream* os_;
+  const ImageHeader& image_header_;
+  const char* image_location_;
+  pid_t image_diff_pid_;  // Dump image diff against boot.art if pid is non-negative
+
+  DISALLOW_COPY_AND_ASSIGN(ImgDiagDumper);
+};
+
+static int DumpImage(Runtime* runtime, const char* image_location,
+                     std::ostream* os, pid_t image_diff_pid) {
+  ScopedObjectAccess soa(Thread::Current());
+  gc::Heap* heap = runtime->GetHeap();
+  gc::space::ImageSpace* image_space = heap->GetImageSpace();
+  CHECK(image_space != nullptr);
+  const ImageHeader& image_header = image_space->GetImageHeader();
+  if (!image_header.IsValid()) {
+    fprintf(stderr, "Invalid image header %s\n", image_location);
+    return EXIT_FAILURE;
+  }
+
+  ImgDiagDumper img_diag_dumper(os, image_header, image_location, image_diff_pid);
+
+  bool success = img_diag_dumper.Dump();
+  return (success) ? EXIT_SUCCESS : EXIT_FAILURE;
+}
+
+struct ImgDiagArgs : public CmdlineArgs {
+ protected:
+  using Base = CmdlineArgs;
+
+  virtual ParseStatus ParseCustom(const StringPiece& option,
+                                  std::string* error_msg) OVERRIDE {
+    {
+      ParseStatus base_parse = Base::ParseCustom(option, error_msg);
+      if (base_parse != kParseUnknownArgument) {
+        return base_parse;
+      }
+    }
+
+    if (option.starts_with("--image-diff-pid=")) {
+      const char* image_diff_pid = option.substr(strlen("--image-diff-pid=")).data();
+
+      if (!ParseInt(image_diff_pid, &image_diff_pid_)) {
+        *error_msg = "Image diff pid out of range";
+        return kParseError;
+      }
+    } else {
+      return kParseUnknownArgument;
+    }
+
+    return kParseOk;
+  }
+
+  virtual ParseStatus ParseChecks(std::string* error_msg) OVERRIDE {
+    // Perform the parent checks.
+    ParseStatus parent_checks = Base::ParseChecks(error_msg);
+    if (parent_checks != kParseOk) {
+      return parent_checks;
+    }
+
+    // Perform our own checks.
+
+    if (kill(image_diff_pid_,
+             /*sig*/0) != 0) {  // No signal is sent, perform error-checking only.
+      // Check if the pid exists before proceeding.
+      if (errno == ESRCH) {
+        *error_msg = "Process specified does not exist";
+      } else {
+        *error_msg = StringPrintf("Failed to check process status: %s", strerror(errno));
+      }
+      return kParseError;
+    } else if (instruction_set_ != kRuntimeISA) {
+      // Don't allow different ISAs since the images are ISA-specific.
+      // Right now the code assumes both the runtime ISA and the remote ISA are identical.
+      *error_msg = "Must use the default runtime ISA; changing ISA is not supported.";
+      return kParseError;
+    }
+
+    return kParseOk;
+  }
+
+  virtual std::string GetUsage() const {
+    std::string usage;
+
+    usage +=
+        "Usage: imgdiag [options] ...\n"
+        "    Example: imgdiag --image-diff-pid=$(pidof dex2oat)\n"
+        "    Example: adb shell imgdiag --image-diff-pid=$(pid zygote)\n"
+        "\n";
+
+    usage += Base::GetUsage();
+
+    usage +=  // Optional.
+        "  --image-diff-pid=<pid>: provide the PID of a process whose boot.art you want to diff.\n"
+        "      Example: --image-diff-pid=$(pid zygote)\n"
+        "\n";
+
+    return usage;
+  }
+
+ public:
+  pid_t image_diff_pid_ = -1;
+};
+
+struct ImgDiagMain : public CmdlineMain<ImgDiagArgs> {
+  virtual bool ExecuteWithRuntime(Runtime* runtime) {
+    CHECK(args_ != nullptr);
+
+    return DumpImage(runtime,
+                     args_->boot_image_location_,
+                     args_->os_,
+                     args_->image_diff_pid_) == EXIT_SUCCESS;
+  }
+};
+
+}  // namespace art
+
+int main(int argc, char** argv) {
+  art::ImgDiagMain main;
+  return main.Main(argc, argv);
+}
diff --git a/imgdiag/imgdiag_test.cc b/imgdiag/imgdiag_test.cc
new file mode 100644
index 0000000..1ac7930
--- /dev/null
+++ b/imgdiag/imgdiag_test.cc
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+#include <vector>
+#include <sstream>
+
+#include "common_runtime_test.h"
+
+#include "runtime/os.h"
+#include "runtime/arch/instruction_set.h"
+#include "runtime/utils.h"
+#include "runtime/gc/space/image_space.h"
+#include "runtime/gc/heap.h"
+#include "base/stringprintf.h"
+
+#include <sys/types.h>
+#include <unistd.h>
+
+namespace art {
+
+static const char* kImgDiagDiffPid = "--image-diff-pid";
+static const char* kImgDiagBootImage = "--boot-image";
+static const char* kImgDiagBinaryName = "imgdiag";
+
+class ImgDiagTest : public CommonRuntimeTest {
+ protected:
+  virtual void SetUp() {
+    CommonRuntimeTest::SetUp();
+
+    // We loaded the runtime with an explicit image. Therefore the image space must exist.
+    gc::space::ImageSpace* image_space = Runtime::Current()->GetHeap()->GetImageSpace();
+    ASSERT_TRUE(image_space != nullptr);
+    boot_image_location_ = image_space->GetImageLocation();
+  }
+
+  virtual void SetUpRuntimeOptions(RuntimeOptions* options) OVERRIDE {
+    // Needs to live until CommonRuntimeTest::SetUp finishes, since we pass it a cstring.
+    runtime_args_image_ = StringPrintf("-Ximage:%s", GetCoreArtLocation().c_str());
+    options->push_back(std::make_pair(runtime_args_image_, nullptr));
+  }
+
+  // Path to the imgdiag(d?)[32|64] binary.
+  std::string GetImgDiagFilePath() {
+    std::string root = GetTestAndroidRoot();
+
+    root += "/bin/";
+    root += kImgDiagBinaryName;
+
+    if (kIsDebugBuild) {
+      root += "d";
+    }
+
+    std::string root32 = root + "32";
+    // If we have both a 32-bit and a 64-bit build, the 32-bit file will have a 32 suffix.
+    if (OS::FileExists(root32.c_str()) && !Is64BitInstructionSet(kRuntimeISA)) {
+      return root32;
+    // Only a single build exists, so the filename never has an extra suffix.
+    } else {
+      return root;
+    }
+  }
+
+  // Run imgdiag with a custom boot image location.
+  bool Exec(pid_t image_diff_pid, const std::string& boot_image, std::string* error_msg) {
+    // Invoke 'img_diag' against the current process.
+    // This should succeed because we have a runtime and so it should
+    // be able to map in the boot.art and do a diff for it.
+    std::string file_path = GetImgDiagFilePath();
+    EXPECT_TRUE(OS::FileExists(file_path.c_str())) << file_path << " should be a valid file path";
+
+    // Run imgdiag --image-diff-pid=$image_diff_pid and wait until it's done with a 0 exit code.
+    std::string diff_pid_args;
+    {
+      std::stringstream diff_pid_args_ss;
+      diff_pid_args_ss << kImgDiagDiffPid << "=" << image_diff_pid;
+      diff_pid_args = diff_pid_args_ss.str();
+    }
+    std::string boot_image_args;
+    {
+      boot_image_args = boot_image_args + kImgDiagBootImage + "=" + boot_image;
+    }
+
+    std::vector<std::string> exec_argv = { file_path, diff_pid_args, boot_image_args };
+
+    return ::art::Exec(exec_argv, error_msg);
+  }
+
+  // Run imgdiag with the default boot image location.
+  bool ExecDefaultBootImage(pid_t image_diff_pid, std::string* error_msg) {
+    return Exec(image_diff_pid, boot_image_location_, error_msg);
+  }
+
+ private:
+  std::string runtime_args_image_;
+  std::string boot_image_location_;
+};
+
+#if defined (ART_TARGET)
+TEST_F(ImgDiagTest, ImageDiffPidSelf) {
+#else
+// Can't run this test on the host, it will fail when trying to open /proc/kpagestats
+// because it's root read-only.
+TEST_F(ImgDiagTest, DISABLED_ImageDiffPidSelf) {
+#endif
+  // Invoke 'img_diag' against the current process.
+  // This should succeed because we have a runtime and so it should
+  // be able to map in the boot.art and do a diff for it.
+
+  // Run imgdiag --image-diff-pid=$(self pid) and wait until it's done with a 0 exit code.
+  std::string error_msg;
+  ASSERT_TRUE(ExecDefaultBootImage(getpid(), &error_msg)) << "Failed to execute -- because: "
+                                                          << error_msg;
+}
+
+TEST_F(ImgDiagTest, ImageDiffBadPid) {
+  // Invoke 'img_diag' against a non-existing process. This should fail.
+
+  // Run imgdiag --image-diff-pid=some_bad_pid and wait until it's done with a 0 exit code.
+  std::string error_msg;
+  ASSERT_FALSE(ExecDefaultBootImage(-12345, &error_msg)) << "Incorrectly executed";
+  UNUSED(error_msg);
+}
+
+}  // namespace art
diff --git a/oatdump/Android.mk b/oatdump/Android.mk
index b8a3b49..f01afc5 100644
--- a/oatdump/Android.mk
+++ b/oatdump/Android.mk
@@ -21,19 +21,8 @@ include art/build/Android.executable.mk
 OATDUMP_SRC_FILES := \
 	oatdump.cc
 
-ifeq ($(ART_BUILD_TARGET_NDEBUG),true)
-  $(eval $(call build-art-executable,oatdump,$(OATDUMP_SRC_FILES),libcutils libart-disassembler libart-compiler,art/disassembler art/compiler,target,ndebug))
-endif
-ifeq ($(ART_BUILD_TARGET_DEBUG),true)
-  $(eval $(call build-art-executable,oatdump,$(OATDUMP_SRC_FILES),libcutils libartd-disassembler libartd-compiler,art/disassembler art/compiler,target,debug))
-endif
-
-ifeq ($(ART_BUILD_HOST_NDEBUG),true)
-  $(eval $(call build-art-executable,oatdump,$(OATDUMP_SRC_FILES),libart-disassembler libart-compiler,art/disassembler art/compiler,host,ndebug))
-endif
-ifeq ($(ART_BUILD_HOST_DEBUG),true)
-  $(eval $(call build-art-executable,oatdump,$(OATDUMP_SRC_FILES),libartd-disassembler libartd-compiler,art/disassembler art/compiler,host,debug))
-endif
+# Build variants {target,host} x {debug,ndebug}
+$(eval $(call build-art-multi-executable,oatdump,$(OATDUMP_SRC_FILES),libart-compiler libart-disassembler,libcutils,,art/compiler art/disassembler))
 
 ########################################################################
 # oatdump targets
diff --git a/oatdump/oatdump.cc b/oatdump/oatdump.cc
index 5c5e2b4..b989c7f 100644
--- a/oatdump/oatdump.cc
+++ b/oatdump/oatdump.cc
@@ -19,12 +19,13 @@
 
 #include <fstream>
 #include <iostream>
+#include <map>
+#include <set>
 #include <string>
 #include <unordered_map>
 #include <vector>
 
 #include "arch/instruction_set_features.h"
-#include "base/stringpiece.h"
 #include "base/unix_file/fd_file.h"
 #include "class_linker.h"
 #include "class_linker-inl.h"
@@ -45,12 +46,10 @@
 #include "mirror/class-inl.h"
 #include "mirror/object-inl.h"
 #include "mirror/object_array-inl.h"
-#include "noop_compiler_callbacks.h"
 #include "oat.h"
 #include "oat_file-inl.h"
 #include "os.h"
 #include "output_stream.h"
-#include "runtime.h"
 #include "safe_map.h"
 #include "scoped_thread_state_change.h"
 #include "ScopedLocalRef.h"
@@ -60,58 +59,10 @@
 #include "vmap_table.h"
 #include "well_known_classes.h"
 
-namespace art {
+#include <sys/stat.h>
+#include "cmdline.h"
 
-static void usage() {
-  fprintf(stderr,
-          "Usage: oatdump [options] ...\n"
-          "    Example: oatdump --image=$ANDROID_PRODUCT_OUT/system/framework/boot.art\n"
-          "    Example: adb shell oatdump --image=/system/framework/boot.art\n"
-          "\n");
-  fprintf(stderr,
-          "  --oat-file=<file.oat>: specifies an input oat filename.\n"
-          "      Example: --oat-file=/system/framework/boot.oat\n"
-          "\n");
-  fprintf(stderr,
-          "  --image=<file.art>: specifies an input image filename.\n"
-          "      Example: --image=/system/framework/boot.art\n"
-          "\n");
-  fprintf(stderr,
-          "  --boot-image=<file.art>: provide the image file for the boot class path.\n"
-          "      Example: --boot-image=/system/framework/boot.art\n"
-          "\n");
-  fprintf(stderr,
-          "  --instruction-set=(arm|arm64|mips|x86|x86_64): for locating the image\n"
-          "      file based on the image location set.\n"
-          "      Example: --instruction-set=x86\n"
-          "      Default: %s\n"
-          "\n",
-          GetInstructionSetString(kRuntimeISA));
-  fprintf(stderr,
-          "  --output=<file> may be used to send the output to a file.\n"
-          "      Example: --output=/tmp/oatdump.txt\n"
-          "\n");
-  fprintf(stderr,
-          "  --dump:raw_mapping_table enables dumping of the mapping table.\n"
-          "      Example: --dump:raw_mapping_table\n"
-          "\n");
-  fprintf(stderr,
-          "  --dump:raw_mapping_table enables dumping of the GC map.\n"
-          "      Example: --dump:raw_gc_map\n"
-          "\n");
-  fprintf(stderr,
-          "  --no-dump:vmap may be used to disable vmap dumping.\n"
-          "      Example: --no-dump:vmap\n"
-          "\n");
-  fprintf(stderr,
-          "  --no-disassemble may be used to disable disassembly.\n"
-          "      Example: --no-disassemble\n"
-          "\n");
-  fprintf(stderr,
-          "  --method-filter=<method name>: only dumps methods that contain the filter.\n"
-          "      Example: --method-filter=foo\n"
-          "\n");
-}
+namespace art {
 
 const char* image_roots_descriptions_[] = {
   "kResolutionMethod",
@@ -360,15 +311,14 @@ class OatDumperOptions {
                    bool dump_vmap,
                    bool disassemble_code,
                    bool absolute_addresses,
-                   const char* method_filter,
-                   Handle<mirror::ClassLoader>* class_loader)
+                   const char* method_filter)
     : dump_raw_mapping_table_(dump_raw_mapping_table),
       dump_raw_gc_map_(dump_raw_gc_map),
       dump_vmap_(dump_vmap),
       disassemble_code_(disassemble_code),
       absolute_addresses_(absolute_addresses),
       method_filter_(method_filter),
-      class_loader_(class_loader) {}
+      class_loader_(nullptr) {}
 
   const bool dump_raw_mapping_table_;
   const bool dump_raw_gc_map_;
@@ -1983,45 +1933,6 @@ class ImageDumper {
   DISALLOW_COPY_AND_ASSIGN(ImageDumper);
 };
 
-static NoopCompilerCallbacks callbacks;
-
-static Runtime* StartRuntime(const char* boot_image_location, const char* image_location,
-                             InstructionSet instruction_set) {
-  RuntimeOptions options;
-  std::string image_option;
-  std::string oat_option;
-  std::string boot_image_option;
-  std::string boot_oat_option;
-
-  // We are more like a compiler than a run-time. We don't want to execute code.
-  options.push_back(std::make_pair("compilercallbacks", &callbacks));
-
-  if (boot_image_location != nullptr) {
-    boot_image_option += "-Ximage:";
-    boot_image_option += boot_image_location;
-    options.push_back(std::make_pair(boot_image_option.c_str(), nullptr));
-  }
-  if (image_location != nullptr) {
-    image_option += "-Ximage:";
-    image_option += image_location;
-    options.push_back(std::make_pair(image_option.c_str(), nullptr));
-  }
-  options.push_back(
-      std::make_pair("imageinstructionset",
-                     reinterpret_cast<const void*>(GetInstructionSetString(instruction_set))));
-
-  if (!Runtime::Create(options, false)) {
-    fprintf(stderr, "Failed to create runtime\n");
-    return nullptr;
-  }
-
-  // Runtime::Create acquired the mutator_lock_ that is normally given away when we Runtime::Start,
-  // give it away now and then switch to a more manageable ScopedObjectAccess.
-  Thread::Current()->TransitionFromRunnableToSuspended(kNative);
-
-  return Runtime::Current();
-}
-
 static int DumpImage(Runtime* runtime, const char* image_location, OatDumperOptions* options,
                      std::ostream* os) {
   // Dumping the image, no explicit class loader.
@@ -2037,7 +1948,9 @@ static int DumpImage(Runtime* runtime, const char* image_location, OatDumperOpti
     fprintf(stderr, "Invalid image header %s\n", image_location);
     return EXIT_FAILURE;
   }
+
   ImageDumper image_dumper(os, *image_space, image_header, options);
+
   bool success = image_dumper.Dump();
   return (success) ? EXIT_SUCCESS : EXIT_FAILURE;
 }
@@ -2096,7 +2009,8 @@ static int DumpOatWithoutRuntime(OatFile* oat_file, OatDumperOptions* options, s
 static int DumpOat(Runtime* runtime, const char* oat_filename, OatDumperOptions* options,
                    std::ostream* os) {
   std::string error_msg;
-  OatFile* oat_file = OatFile::Open(oat_filename, oat_filename, nullptr, nullptr, false, &error_msg);
+  OatFile* oat_file = OatFile::Open(oat_filename, oat_filename, nullptr, nullptr, false,
+                                    &error_msg);
   if (oat_file == nullptr) {
     fprintf(stderr, "Failed to open oat file from '%s': %s\n", oat_filename, error_msg.c_str());
     return EXIT_FAILURE;
@@ -2111,7 +2025,8 @@ static int DumpOat(Runtime* runtime, const char* oat_filename, OatDumperOptions*
 
 static int SymbolizeOat(const char* oat_filename, std::string& output_name) {
   std::string error_msg;
-  OatFile* oat_file = OatFile::Open(oat_filename, oat_filename, nullptr, nullptr, false, &error_msg);
+  OatFile* oat_file = OatFile::Open(oat_filename, oat_filename, nullptr, nullptr, false,
+                                    &error_msg);
   if (oat_file == nullptr) {
     fprintf(stderr, "Failed to open oat file from '%s': %s\n", oat_filename, error_msg.c_str());
     return EXIT_FAILURE;
@@ -2130,86 +2045,110 @@ static int SymbolizeOat(const char* oat_filename, std::string& output_name) {
   return EXIT_SUCCESS;
 }
 
-struct OatdumpArgs {
-  bool Parse(int argc, char** argv) {
-    // Skip over argv[0].
-    argv++;
-    argc--;
+struct OatdumpArgs : public CmdlineArgs {
+ protected:
+  using Base = CmdlineArgs;
 
-    if (argc == 0) {
-      fprintf(stderr, "No arguments specified\n");
-      usage();
-      return false;
+  virtual ParseStatus ParseCustom(const StringPiece& option,
+                                  std::string* error_msg) OVERRIDE {
+    {
+      ParseStatus base_parse = Base::ParseCustom(option, error_msg);
+      if (base_parse != kParseUnknownArgument) {
+        return base_parse;
+      }
     }
 
-    for (int i = 0; i < argc; i++) {
-      const StringPiece option(argv[i]);
-      if (option.starts_with("--oat-file=")) {
-        oat_filename_ = option.substr(strlen("--oat-file=")).data();
-      } else if (option.starts_with("--image=")) {
-        image_location_ = option.substr(strlen("--image=")).data();
-      } else if (option.starts_with("--boot-image=")) {
-        boot_image_location_ = option.substr(strlen("--boot-image=")).data();
-      } else if (option.starts_with("--instruction-set=")) {
-        StringPiece instruction_set_str = option.substr(strlen("--instruction-set=")).data();
-        instruction_set_ = GetInstructionSetFromString(instruction_set_str.data());
-        if (instruction_set_ == kNone) {
-          fprintf(stderr, "Unsupported instruction set %s\n", instruction_set_str.data());
-          usage();
-          return false;
-        }
-      } else if (option =="--dump:raw_mapping_table") {
-        dump_raw_mapping_table_ = true;
-      } else if (option == "--dump:raw_gc_map") {
-        dump_raw_gc_map_ = true;
-      } else if (option == "--no-dump:vmap") {
-        dump_vmap_ = false;
-      } else if (option == "--no-disassemble") {
-        disassemble_code_ = false;
-      } else if (option.starts_with("--output=")) {
-        output_name_ = option.substr(strlen("--output=")).ToString();
-        const char* filename = output_name_.c_str();
-        out_.reset(new std::ofstream(filename));
-        if (!out_->good()) {
-          fprintf(stderr, "Failed to open output filename %s\n", filename);
-          usage();
-          return false;
-        }
-        os_ = out_.get();
-      } else if (option.starts_with("--symbolize=")) {
-        oat_filename_ = option.substr(strlen("--symbolize=")).data();
-        symbolize_ = true;
-      } else if (option.starts_with("--method-filter=")) {
-        method_filter_ = option.substr(strlen("--method-filter=")).data();
-      } else {
-        fprintf(stderr, "Unknown argument %s\n", option.data());
-        usage();
-        return false;
-      }
+    if (option.starts_with("--oat-file=")) {
+      oat_filename_ = option.substr(strlen("--oat-file=")).data();
+    } else if (option.starts_with("--image=")) {
+      image_location_ = option.substr(strlen("--image=")).data();
+    } else if (option =="--dump:raw_mapping_table") {
+      dump_raw_mapping_table_ = true;
+    } else if (option == "--dump:raw_gc_map") {
+      dump_raw_gc_map_ = true;
+    } else if (option == "--no-dump:vmap") {
+      dump_vmap_ = false;
+    } else if (option == "--no-disassemble") {
+      disassemble_code_ = false;
+    } else if (option.starts_with("--symbolize=")) {
+      oat_filename_ = option.substr(strlen("--symbolize=")).data();
+      symbolize_ = true;
+    } else if (option.starts_with("--method-filter=")) {
+      method_filter_ = option.substr(strlen("--method-filter=")).data();
+    } else {
+      return kParseUnknownArgument;
     }
 
-    if (image_location_ == nullptr && oat_filename_ == nullptr) {
-      fprintf(stderr, "Either --image or --oat must be specified\n");
-      return false;
+    return kParseOk;
+  }
+
+  virtual ParseStatus ParseChecks(std::string* error_msg) OVERRIDE {
+    // Infer boot image location from the image location if possible.
+    if (boot_image_location_ == nullptr) {
+      boot_image_location_ = image_location_;
     }
 
-    if (image_location_ != nullptr && oat_filename_ != nullptr) {
-      fprintf(stderr, "Either --image or --oat must be specified but not both\n");
-      return false;
+    // Perform the parent checks.
+    ParseStatus parent_checks = Base::ParseChecks(error_msg);
+    if (parent_checks != kParseOk) {
+      return parent_checks;
     }
 
-    return true;
+    // Perform our own checks.
+    if (image_location_ == nullptr && oat_filename_ == nullptr) {
+      *error_msg = "Either --image or --oat-file must be specified";
+      return kParseError;
+    } else if (image_location_ != nullptr && oat_filename_ != nullptr) {
+      *error_msg = "Either --image or --oat-file must be specified but not both";
+      return kParseError;
+    }
+
+    return kParseOk;
+  }
+
+  virtual std::string GetUsage() const {
+    std::string usage;
+
+    usage +=
+        "Usage: oatdump [options] ...\n"
+        "    Example: oatdump --image=$ANDROID_PRODUCT_OUT/system/framework/boot.art\n"
+        "    Example: adb shell oatdump --image=/system/framework/boot.art\n"
+        "\n"
+        // Either oat-file or image is required.
+        "  --oat-file=<file.oat>: specifies an input oat filename.\n"
+        "      Example: --oat-file=/system/framework/boot.oat\n"
+        "\n"
+        "  --image=<file.art>: specifies an input image location.\n"
+        "      Example: --image=/system/framework/boot.art\n"
+        "\n";
+
+    usage += Base::GetUsage();
+
+    usage +=  // Optional.
+        "  --dump:raw_mapping_table enables dumping of the mapping table.\n"
+        "      Example: --dump:raw_mapping_table\n"
+        "\n"
+        "  --dump:raw_mapping_table enables dumping of the GC map.\n"
+        "      Example: --dump:raw_gc_map\n"
+        "\n"
+        "  --no-dump:vmap may be used to disable vmap dumping.\n"
+        "      Example: --no-dump:vmap\n"
+        "\n"
+        "  --no-disassemble may be used to disable disassembly.\n"
+        "      Example: --no-disassemble\n"
+        "\n"
+        "  --method-filter=<method name>: only dumps methods that contain the filter.\n"
+        "      Example: --method-filter=foo\n"
+        "\n";
+
+    return usage;
   }
 
+ public:
   const char* oat_filename_ = nullptr;
   const char* method_filter_ = "";
   const char* image_location_ = nullptr;
-  const char* boot_image_location_ = nullptr;
-  InstructionSet instruction_set_ = kRuntimeISA;
   std::string elf_filename_prefix_;
-  std::ostream* os_ = &std::cout;
-  std::unique_ptr<std::ofstream> out_;
-  std::string output_name_;
   bool dump_raw_mapping_table_ = false;
   bool dump_raw_gc_map_ = false;
   bool dump_vmap_ = true;
@@ -2217,55 +2156,54 @@ struct OatdumpArgs {
   bool symbolize_ = false;
 };
 
-static int oatdump(int argc, char** argv) {
-  InitLogging(argv);
+struct OatdumpMain : public CmdlineMain<OatdumpArgs> {
+  virtual bool NeedsRuntime() OVERRIDE {
+    CHECK(args_ != nullptr);
 
-  OatdumpArgs args;
-  if (!args.Parse(argc, argv)) {
-    return EXIT_FAILURE;
+    // If we are only doing the oat file, disable absolute_addresses. Keep them for image dumping.
+    bool absolute_addresses = (args_->oat_filename_ == nullptr);
+
+    oat_dumper_options_ = std::unique_ptr<OatDumperOptions>(new OatDumperOptions(
+        args_->dump_raw_mapping_table_,
+        args_->dump_raw_gc_map_,
+        args_->dump_vmap_,
+        args_->disassemble_code_,
+        absolute_addresses,
+        args_->method_filter_));
+
+    return (args_->boot_image_location_ != nullptr || args_->image_location_ != nullptr) &&
+          !args_->symbolize_;
   }
 
-  // If we are only doing the oat file, disable absolute_addresses. Keep them for image dumping.
-  bool absolute_addresses = (args.oat_filename_ == nullptr);
-
-  std::unique_ptr<OatDumperOptions> oat_dumper_options(new OatDumperOptions(
-      args.dump_raw_mapping_table_,
-      args.dump_raw_gc_map_,
-      args.dump_vmap_,
-      args.disassemble_code_,
-      absolute_addresses,
-      args.method_filter_,
-      nullptr));
-
-  std::unique_ptr<Runtime> runtime;
-  if ((args.boot_image_location_ != nullptr || args.image_location_ != nullptr) &&
-      !args.symbolize_) {
-    // If we have a boot image option, try to start the runtime; except when just symbolizing.
-    runtime.reset(StartRuntime(args.boot_image_location_,
-                               args.image_location_,
-                               args.instruction_set_));
-  } else {
+  virtual bool ExecuteWithoutRuntime() OVERRIDE {
+    CHECK(args_ != nullptr);
+    CHECK(args_->symbolize_);
+
     MemMap::Init();
+
+    return SymbolizeOat(args_->oat_filename_, args_->output_name_) == EXIT_SUCCESS;
   }
 
-  if (args.oat_filename_ != nullptr) {
-    if (args.symbolize_) {
-      return SymbolizeOat(args.oat_filename_, args.output_name_);
-    } else {
-      return DumpOat(runtime.get(), args.oat_filename_, oat_dumper_options.release(), args.os_);
+  virtual bool ExecuteWithRuntime(Runtime* runtime) {
+    CHECK(args_ != nullptr);
+
+    if (args_->oat_filename_ != nullptr) {
+      return DumpOat(runtime,
+                     args_->oat_filename_,
+                     oat_dumper_options_.release(),
+                     args_->os_) == EXIT_SUCCESS;
     }
-  }
 
-  if (runtime.get() == nullptr) {
-    // We need the runtime when printing an image.
-    return EXIT_FAILURE;
+    return DumpImage(runtime, args_->image_location_, oat_dumper_options_.release(), args_->os_)
+      == EXIT_SUCCESS;
   }
 
-  return DumpImage(runtime.get(), args.image_location_, oat_dumper_options.release(), args.os_);
-}
+  std::unique_ptr<OatDumperOptions> oat_dumper_options_;
+};
 
 }  // namespace art
 
 int main(int argc, char** argv) {
-  return art::oatdump(argc, argv);
+  art::OatdumpMain main;
+  return main.Main(argc, argv);
 }
diff --git a/runtime/base/unix_file/fd_file.cc b/runtime/base/unix_file/fd_file.cc
index 6e5e7a1..780e37a 100644
--- a/runtime/base/unix_file/fd_file.cc
+++ b/runtime/base/unix_file/fd_file.cc
@@ -178,10 +178,16 @@ bool FdFile::IsOpened() const {
   return fd_ >= 0;
 }
 
-bool FdFile::ReadFully(void* buffer, size_t byte_count) {
+static ssize_t ReadIgnoreOffset(int fd, void *buf, size_t count, off_t offset) {
+  DCHECK_EQ(offset, 0);
+  return read(fd, buf, count);
+}
+
+template <ssize_t (*read_func)(int, void*, size_t, off_t)>
+static bool ReadFullyGeneric(int fd, void* buffer, size_t byte_count, size_t offset) {
   char* ptr = static_cast<char*>(buffer);
   while (byte_count > 0) {
-    ssize_t bytes_read = TEMP_FAILURE_RETRY(read(fd_, ptr, byte_count));
+    ssize_t bytes_read = TEMP_FAILURE_RETRY(read_func(fd, ptr, byte_count, offset));
     if (bytes_read <= 0) {
       // 0: end of file
       // -1: error
@@ -189,10 +195,19 @@ bool FdFile::ReadFully(void* buffer, size_t byte_count) {
     }
     byte_count -= bytes_read;  // Reduce the number of remaining bytes.
     ptr += bytes_read;  // Move the buffer forward.
+    offset += static_cast<size_t>(bytes_read);  // Move the offset forward.
   }
   return true;
 }
 
+bool FdFile::ReadFully(void* buffer, size_t byte_count) {
+  return ReadFullyGeneric<ReadIgnoreOffset>(fd_, buffer, byte_count, 0);
+}
+
+bool FdFile::PreadFully(void* buffer, size_t byte_count, size_t offset) {
+  return ReadFullyGeneric<pread>(fd_, buffer, byte_count, offset);
+}
+
 bool FdFile::WriteFully(const void* buffer, size_t byte_count) {
   const char* ptr = static_cast<const char*>(buffer);
   moveTo(GuardState::kBase, GuardState::kClosed, "Writing into closed file.");
diff --git a/runtime/base/unix_file/fd_file.h b/runtime/base/unix_file/fd_file.h
index 8db2ee4..1b1fb4e 100644
--- a/runtime/base/unix_file/fd_file.h
+++ b/runtime/base/unix_file/fd_file.h
@@ -74,6 +74,7 @@ class FdFile : public RandomAccessFile {
   }
   void DisableAutoClose();
   bool ReadFully(void* buffer, size_t byte_count) WARN_UNUSED;
+  bool PreadFully(void* buffer, size_t byte_count, size_t offset) WARN_UNUSED;
   bool WriteFully(const void* buffer, size_t byte_count) WARN_UNUSED;
 
   // This enum is public so that we can define the << operator over it.
diff --git a/runtime/base/unix_file/fd_file_test.cc b/runtime/base/unix_file/fd_file_test.cc
index a7e5b96..388f717 100644
--- a/runtime/base/unix_file/fd_file_test.cc
+++ b/runtime/base/unix_file/fd_file_test.cc
@@ -76,4 +76,38 @@ TEST_F(FdFileTest, ReadFullyEmptyFile) {
   EXPECT_FALSE(file.ReadFully(&buffer, 4));
 }
 
+template <size_t Size>
+static void NullTerminateCharArray(char (&array)[Size]) {
+  array[Size - 1] = '\0';
+}
+
+TEST_F(FdFileTest, ReadFullyWithOffset) {
+  // New scratch file, zero-length.
+  art::ScratchFile tmp;
+  FdFile file;
+  ASSERT_TRUE(file.Open(tmp.GetFilename(), O_RDWR));
+  EXPECT_GE(file.Fd(), 0);
+  EXPECT_TRUE(file.IsOpened());
+
+  char ignore_prefix[20] = {'a', };
+  NullTerminateCharArray(ignore_prefix);
+  char read_suffix[10] = {'b', };
+  NullTerminateCharArray(read_suffix);
+
+  off_t offset = 0;
+  // Write scratch data to file that we can read back into.
+  EXPECT_TRUE(file.Write(ignore_prefix, sizeof(ignore_prefix), offset));
+  offset += sizeof(ignore_prefix);
+  EXPECT_TRUE(file.Write(read_suffix, sizeof(read_suffix), offset));
+
+  ASSERT_EQ(file.Flush(), 0);
+
+  // Reading at an offset should only produce 'bbbb...', since we ignore the 'aaa...' prefix.
+  char buffer[sizeof(read_suffix)];
+  EXPECT_TRUE(file.PreadFully(buffer, sizeof(read_suffix), offset));
+  EXPECT_STREQ(&read_suffix[0], &buffer[0]);
+
+  ASSERT_EQ(file.Close(), 0);
+}
+
 }  // namespace unix_file
diff --git a/runtime/common_runtime_test.cc b/runtime/common_runtime_test.cc
index 03b33e9..3d7bf53 100644
--- a/runtime/common_runtime_test.cc
+++ b/runtime/common_runtime_test.cc
@@ -169,6 +169,13 @@ void CommonRuntimeTest::TearDownAndroidData(const std::string& android_data, boo
   }
 }
 
+std::string CommonRuntimeTest::GetCoreArtLocation() {
+  return GetCoreFileLocation("art");
+}
+
+std::string CommonRuntimeTest::GetCoreOatLocation() {
+  return GetCoreFileLocation("oat");
+}
 
 const DexFile* CommonRuntimeTest::LoadExpectSingleDexFile(const char* location) {
   std::vector<const DexFile*> dex_files;
@@ -358,6 +365,21 @@ jobject CommonRuntimeTest::LoadDex(const char* dex_name) {
   return class_loader;
 }
 
+std::string CommonRuntimeTest::GetCoreFileLocation(const char* suffix) {
+  CHECK(suffix != nullptr);
+
+  std::string location;
+  if (IsHost()) {
+    const char* host_dir = getenv("ANDROID_HOST_OUT");
+    CHECK(host_dir != NULL);
+    location = StringPrintf("%s/framework/core.%s", host_dir, suffix);
+  } else {
+    location = StringPrintf("/data/art-test/core.%s", suffix);
+  }
+
+  return location;
+}
+
 CheckJniAbortCatcher::CheckJniAbortCatcher() : vm_(Runtime::Current()->GetJavaVM()) {
   vm_->SetCheckJniAbortHook(Hook, &actual_);
 }
diff --git a/runtime/common_runtime_test.h b/runtime/common_runtime_test.h
index 1b56835..edc3e1e 100644
--- a/runtime/common_runtime_test.h
+++ b/runtime/common_runtime_test.h
@@ -80,6 +80,12 @@ class CommonRuntimeTest : public testing::Test {
     return !kIsTargetBuild;
   }
 
+  // File location to core.art, e.g. $ANDROID_HOST_OUT/system/framework/core.art
+  static std::string GetCoreArtLocation();
+
+  // File location to core.oat, e.g. $ANDROID_HOST_OUT/system/framework/core.oat
+  static std::string GetCoreOatLocation();
+
   const DexFile* LoadExpectSingleDexFile(const char* location);
 
   virtual void SetUp();
@@ -115,6 +121,8 @@ class CommonRuntimeTest : public testing::Test {
   ClassLinker* class_linker_;
 
  private:
+  static std::string GetCoreFileLocation(const char* suffix);
+
   std::unique_ptr<CompilerCallbacks> callbacks_;
   std::vector<const DexFile*> opened_dex_files_;
 };