void create_dump(void) { if(!fork()) { // Crash the app in your favorite way here *((void*)0) = 42; } } Fork the process then crash the child – it’ll give you a snapshot whenever you want
Linux Activate your coredumps by the following command: ulimit -c unlimited Also, check the core_pattern value by: sysctl kernel.core_pattern to see where your dumps are created (%e will be the process name, and %t will be the system time). You can change it in /etc/sysctl.conf and then reload by sysctl -p. You can test it … Read more
If you have a core file and you have compiled the program with debugging options (-g), you can see where the core was dumped: $ gcc -g -o something something.c $ ./something Segmentation fault (core dumped) $ gdb something core You can use this to do some post-morten debugging. A few gdb commands: bt prints … Read more
Start gdb without specifying the executable or core file, then type the following commands: set solib-absolute-prefix ./usr file path/to/executable core-file path/to/corefile You will need to make sure to mirror your library path exactly from the target system. The above is meant for debugging targets that don’t match your host, that is why it’s important to … Read more
kill -QUIT process_id will cause a core dump from a running process (assuming that resource limits allow it). Or see man 3 abort for causing a program to dump itself. Added: From an interactive shell, a running program can be made to abort with the quit key, usually Ctrl+\, which sends a SIGQUIT just as … Read more
You could use the “dump” function of gdb, see: https://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html For your example: dump binary memory result.bin 0x200000000 0x20000c350 This will give you a plain binary dump int file result.bin. You can also use the following to dump it in hex format: dump ihex memory result.bin 0x200000000 0x20000c350 Using the dump command is much clearer … Read more
Okay if you’ve created the core dump with gcore or gdb then you’ll need to convert it to something called a HPROF file. These can be used by VisualVM, Netbeans or Eclipse’s Memory Analyzer Tool (formerly SAP Memory Analyzer). I’d recommend Eclipse MAT. To convert the file use the commandline tool jmap. # jmap -dump:format=b,file=dump.hprof … Read more
By default, crashes are reported into .crash files which can be found in /Library/Logs/DiagnosticReports (system-wide) and ~/Library/Logs/DiagnosticReports (user). These files can be opened by using Console app, in User or System Reports. The .crash files are in plain text format and should include relevant information about the crash. In order to activate the full core … Read more
Yes, it is. You can change /proc/sys/kernel/core_pattern to define the pathname used to generate the corefile. For more, see man core example: echo ‘/tmp/core_%e.%p’ | sudo tee /proc/sys/kernel/core_pattern # `tee’ instead of > so that # opening happens in the # elevated process would cause all future core dumps to be generated in /tmp and … Read more
gdb /usr/bin/myapp.binary corefile Then, use one of: (gdb) bt (gdb) bt full (gdb) info threads (gdb) thread apply all bt (gdb) thread apply all bt full Note that installing debug symbols for the related libraries will help