What exactly is and what does a core dump of process contain

core-dumpdebugginggdbmemoryprocess

It's clear that GDB can generate a core dump of process for example via its wrapper – gcore, however it's not clear what exactly it includes and it's really hard to find an answear because different sources say totally different things.

Because of that I've got following questions:

Does it contain a whole virtual memory of process? If not, what part of it? All writable regions or stack only or just (as its name suggests) some essential part or what?
Is it possible to generate a core file with complete memory of process via GDB? If so, how?
What would be the difference between a "dump" generated by saving and concatenating memory from all regions according to process' memory map and automatically generated file with gcore command?
A process wrote some data somewhere into RAM. Can I be sure that the data will be (always) accessed and saved in a core file generated with gcore command? If not, why? What does it depend on?

Best Answer

The core file contains all the parts of the process's virtual memory that are specific to that process, which is generally the data and stack segments. It doesn't include the text segment, which contains the executable code -- when you want to debug a core file, you have to tell the debugger what program was being run.

You can find a detailed explanation of the contents at Anatomy of an ELF core file

Related Solutions

Ubuntu – No core dump on Ubuntu on a Parallels shared folder

I couldn't clearly find the underlying reason why, but the zero length core file was caused by trying to create the core file on a Parallels Shared Folder.

I solved the problem by running the application from a local directory. I suppose another alternative would be to set /proc/sys/kernel/core_pattern to dump core files into a local directory.

Dump process core without killing the process

The usual trick is to have something (possibly a signal like SIGUSR1) trigger the program to fork(), then the child calls abort() to make itself dump core.

from os import fork, abort
(...)
def onUSR1(sig, frame):
    if os.fork == 0:
        os.abort

and during initialization

from signal import signal, SIGUSR1
from wherever import onUSR1
(...)
signal.signal(signal.SIGUSR1, wherever.onUSR1)

Used this way, fork won't consume much extra memory because almost all of the address space will be shared (which is also why this works for generating the core dump).

Once upon a time this trick was used with a program called undump to generate an executable from a core dump to save an image after complex initialization; emacs used to do this to generate a preloaded image from temacs.

Best Answer

Related Solutions

Ubuntu – No core dump on Ubuntu on a Parallels shared folder

Dump process core without killing the process

Related Question