How to use Coredumps when a program crashes

Feed

date: 2021-12-02 12:22:18

categories: C

firstPublishDate: 2021-09-30 21:16:49

A core dump is a file generated by the kernel saving the image of the memory when a crash occured and a signal was caught. The signals generating code dump are: `sigabrt`, `sigbus`, `sigfpe`, `sigill`, `sigquit`, `sigsegv`, `sigsys`, `sigtrap`, `sigxcpu` and `sigxfsz`.

Core dumps allow running a program normally and debug a crash as if the program was running in gdb. When loading a core dump in gdb, the process is not recreated but the memory can be inspected. Since the process is not recreated, it is not possible to call functions from the gdb prompt.

To get the core dump documentation in the terminal, run:

man core

In linux `/proc/sys/kernel/core_pattern` can be set to define a template for the core dump filenames, for example:

# core ExePath signal number UserId ProcessId
echo "core%E.signal%s.uid%u.pid%p" > /proc/sys/kernel/core_pattern

Enable core dumps (in bash)

By default, core dumps are not generated, to enable core dumps run this command on the bash prompt:

ulimit -c unlimited

The default sigaction has to be called for the core dump to be generated, when setting a new signal handler save the default sigaction struct and at the end of the new signal handler call the default one.

For a concrete example, look at

this commit

Enable core dumps in a C program

Core dumps are enabled with the `getrlimit` and `setrlimit` functions and the resource is RLIMIT_CORE. First read the current value for RLIMIT_CORE and then set to unlimited size:

#include <sys/time.h>
#include <sys/resource.h>

struct rlimit limit;
getrlimit(RLIMIT_CORE, &limit);
limit.rlim_cur = RLIM_INFINITY;
setrlimit(RLIMIT_CORE, &limit);

Analyze a coredump

For easier debug, the executable should have a debug symbols. Core dumps are analyzed in gdb, like this:

# compile and crash a program:
# gcc -g3 -o test test.c
# ./test
#
# open core dump file in gdb:
# gdb -tui ./test core.24897

gdb -tui progExe coreDumpFile

hashtags: #cprogramming

Feed

-- Response ended

-- Page fetched on Tue May 21 10:58:51 2024