Technical Blog Post
Abstract
== DEBUGGING CORE FILES [01] == WHAT IS A CORE FILE?
Body
== DEBUGGING CORE FILES [01] == WHAT IS A CORE FILE? A core file is the (almost complete) image of the running process in memory. Core files can be created on demand using gencore, gcore or other commands but most of the time they are the result of a fault in the executing program. They are useful for finding what was wrong at the time a process crashed because they provide us with access to most of the data that the program was using when it crashed. While the internal format of a core file will depend based on the machine you are working on (ELF/XCOFF) the organization of the file itself is very similar. It contains some blocks that are copies of various memory regions used by the process and some headers for a debugger or a C program to navigate the file. It will also contain a few extra structures that contain various information about the user, process and threads. The following image shows the layout of a process and what the corresponding core file would contain. Note that the order of regions will vary depending on he platform you are running on. The same applies to the core file, the layout will depend on the format (ELF/XCOFF).
|
|
PROGRAM TEXT | COREDUMP HEADER |
PROGRAM DATA | COREDUMP EXTRA HEADERS |
HEAP | PROGRAM DATA |
SHARED MEMORY SEGMENT 1 | HEAP |
STACK FOR THREAD 1 | SHARED MEMORY SEGMENT 1 |
SHARED LIBRARY 1 TEXT | STACK FOR THREAD 1 |
SHARED LIBRARY 1 DATA | SHARED LIBRARY 1 DATA |
SHARED LIBRARY 2 TEXT | SHARED LIBRARY 2 DATA |
SHARED LIBRARY 2 DATA | STACK |
STACK | ADDITIONAL INFO |
We can see various regions. The 'text' sections contain the instructions that are executed. The 'data' sections contain global, static variables as well as relocation tables and so on. The 'stack', the 'heap' as well as possible 'anon' (anonymous mmap) and shared memory regions. Note that the core file will omit some regions like the 'text' ones which is why it is always important to provide the executable as well as the shared libraries or other objects that the executable was using at the time the core file was generated.
[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSEPGG","label":"Db2 for Linux, UNIX and Windows"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]
UID
ibm11140250