Core-dump file format

Question

I have written a custom core-dump handling application for a project. I have changed '/proc/sys/kernel/core_pattern' to call my dump-handler and its invoked successfully.

Now the issue is saving the core-dump into a file that can be recognized by gdb. Currently my dump-handler read the dump from STDIN and save it into a file 'core.dump'. When I try to load this core dump into gdb it gives me error:

(gdb) ... is not a core dump: File format not recognized

When I run 'file' command on a standard core dump it give me following:

core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from './dump_gen'

And for custom generated dump, 'file' gives following:

core.dump: data

Please can anyone help me how to write core-dump correctly so it can be used in gdb.

PS: I don't want to use standard core dump file.

Answer 1

I think you somehow don't write all the data to the core file.

Create a simple script, make it executable and set the core pattern to the script.

#!/bin/sh
cat > /tmp/core.$$

Now generate a core file (for example run sleep 1243 and press ctrl+\) and it should work.

I just tested it myself on my system and it works without a problem.

Answer 2

The first thing to check that comes to mind is the Elf header flag that indicates what kind of file it is. It has four values - shared object, unlinked object, executable and core dump. That's most likely what's causing gdb errors.

Also, try examining it with objdump - it can pull apart the entire ELF file for analysis what part of it is apparently not good.

You can find the ELF spec at https://refspecs.linuxbase.org/elf/elf.pdf