- A core file contains the memory image of a process, and (assuming the program within the process contains debug info) its stack trace, contents of variables, and so on.
- A program is normally set to generate a core file containing its memory image when it crashes due to signals such as SEGV or BUS.
- Provided that the shell invoking the program was not set to limit the size of this core file, we will find this file in the working directory of the process (either the directory from which it was started, or the directory it last switched to using the chdir system call).
- Once we get such a core file, we can look at it by issuing the following command:
$gdb /path/to/program/debugme core
This assumes the program was launched using this path, and the core file is in the current directory. If it is not, we can give the path to the core file.
- When we get the debugger's prompt (assuming the core file was successfully read), we can issue commands such as "print", "where" or "frame X".
- We can not issue commands that imply execution (such as "next", or the invocation of function calls).
- In some situations, we will be able to see what caused the crash. One should note that if the program crashed due to invalid memory address access, this will imply that the memory of the program was corrupt, and thus that the core file is corrupt as well, and thus contains bad memory contents, invalid stack frames, etc.
- Thus, we should see the core file's contents as one possible past, out of many probable pasts.
Cem Ozdogan
2011-02-14
