CODEWITHSUNDEEP
linuxgdbcoredump
Rndp13
Rndp13

Reputation: 1122

How to gather information/debug when we have only the core file

I have came across a situation where we have only the core file (no executable). How can i use the core file with gdb or any other tool to gather as much information as possible.

gdb core
GNU gdb (GDB) SUSE (7.1-8.9.1)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-suse-linux".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
"/home/core": not in executable format: File format not recognized

Upvotes: 1

Views: 196

Answers (2)

Banyoghurt
Banyoghurt

Reputation: 315

You might have some luck using the build ids to match the core file with one or more executable.

The gist is running eu-unstrip -n --core $core_file and searching for binaries matching the build ids (something along the lines of find -type f -executable .. .. readelf -n .. grep "Build ID:").

If it's a distro binary, your distro might help you with that. See here.

Upvotes: 0

Employed Russian
Employed Russian

Reputation: 213646

I have came across a situation where we have only the core file (no executable).

Surely you have the executable somewhere? Get a copy of it if you can.

How can i use the core file with gdb or any other tool to gather as much information as possible.

Unless you configured the host to dump file-backed shared mappings (see coredump_filterdocumentation), you simply can't extract much meaningful info from the core.

gdb core

Don't do that. Do this instead: gdb -c core. Then where, and info registers and possibly print $_siginfo may provide something, but it will not be much.

Upvotes: 1

Related Questions