Core Dump File Format

Have written a custom core-dump handling application for a project. changed ‘/pros/sys/kernel/core pattern’ to call my dump-handler and its invoked successfully.

Now the issue is saving the core-dump into a file that can be recognized by gab. Currently dump-handler read the dump from STDIN and save it into a file ‘core. Dump’. When try to load this core dump into gab it gives me error:

(gdb) ... is not a core dump: File format not recognized

When run ‘file’ command on a standard core dump it give me following:

core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from './dump_gen'

And for custom generated dump, ‘file’ gives following:

core.dump: data

how to write core-dump correctly so it can be used in gdb.

PS: don’t want to use standard core dump file.

 think you somehow don’t write all the data to the core file.

Create a simple script, make it executable and set the core pattern to the script.

#!/bin/sh
cat > /tmp/core.$$

Now generate a core file (for example run sleep 1243 and press ctrl+\) and it should work.

just tested it system and it works without a problem.

The first thing to check that comes to mind is the Elf header flag that indicates what kind of file it is. It has four values – shared object, unlinked object, executable and core dump. That’s most likely what’s causing gdb errors.

Also, try examining it with objdump – it can pull apart the entire ELF file for analysis what part of it is apparently not good.

You can find the ELF spec at https://refspecs.linuxbase.org/elf/elf.pdf

This Post Has One Comment

  1. sovis

    Additional information about the process that generated the core file is stored in an ELF note section, albeit in an operating system specific manner. For example, see the core(5) manual page for NetBSD.

Leave a Reply