Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is a core dump executable by itself?

The Wikipedia page on Core dump says

In Unix-like systems, core dumps generally use the standard executable image-format:

a.out in older versions of Unix,
ELF in modern Linux, System V, Solaris, and BSD systems,
Mach-O in OS X, etc.

Does this mean a core dump is executable by itself? If not, why not?

Edit: Since @WumpusQ.Wumbley mentions a coredump_filter in a comment, perhaps the above question should be: can a core dump be produced such that it is executable by itself?

like image 992
Sundar R Avatar asked Aug 05 '13 06:08

Sundar R


People also ask

Where does a core dump go?

By default, core dumps are sent to systemd-coredump which can be configured in /etc/systemd/coredump. conf . By default, all core dumps are stored in /var/lib/systemd/coredump (due to Storage=external ) and they are compressed with zstd (due to Compress=yes ).

What are the differences between the core dump and the crash dump?

Re: Core Dump Vs Crash DumpCore dump - Application use ,, Used to dump some Application core files, If was there any Application realted issues. crash dump -> This Used for both Application & System hardware & software failure.

How does core dump work?

A core dump is a file that gets automatically generated by the Linux kernel after a program crashes. This file contains the memory, register values, and the call stack of an application at the point of crashing.


1 Answers

In older unix variants it was the default to include the text as well as data in the core dump but it was also given in the a.out format and not ELF. Today's default behavior (in Linux for sure, not 100% sure about BSD variants, Solaris etc.) is to have the core dump in ELF format without the text sections but that behavior can be changed.
However, a core dump cannot be executed directly in any case without some help. The reason for that is that there are two things missing from a simple core file. One is the entry point, the other is code to restore the CPU state to the state at or just before the dump occurred (by default also the text sections are missing).
In AIX there used to be a utility called undump but I have no idea what happened to it. It doesn't exist in any standard Linux distribution I know of. As mentioned above (@WumpusQ) there's also an attempt at a similar project for Linux mentioned in above comments, however this project is not complete and doesn't restore the CPU state to the original state. It is, however, still good enough in some specific debugging cases.
It is also worth mentioning that there exist other ELF formatted files that cannot be executes as well which are not core files. Such as object files (compiler output) and .so (shared object) files. Those require a linking stage before being run to resolve external addresses.

like image 190
Reed Avatar answered Sep 27 '22 21:09

Reed