Analyze a Coredump Post-Mortem

Topic Overview

Core Dump Analysis

When a program crashes with a segmentation fault, the operating system can generate a core dump file containing the memory image of the process at the time of crash. This enables post-mortem debugging when you cannot reproduce the crash interactively.

Generating and Analyzing Core Dumps

Enable core dumps:

• ulimit -c unlimited: Allow unlimited core file size
• echo core.%e.%p > /proc/sys/kernel/core_pattern: Set naming pattern

Analyze with GDB:

cCopy
Loading…

For example, a SIGSEGV (signal 11) backtrace might show #0 0x00007fff... in trigger_segfault () with $rip pointing at a NULL pointer dereference.

For This Exercise

You will document how to generate and analyze a core dump after a segmentation fault. Understanding post-mortem debugging is critical for investigating production crashes where the process cannot be restarted under a live debugger.

Reading Crash State

After loading the core, bt full shows local variables at each frame. Examine $rip to find the faulting instruction and x/10x $rsp to inspect stack contents. A NULL pointer dereference shows $rip in a low address range and info registers reveals zero in the source register. Core dumps preserve the entire memory image, so you can inspect heap allocations that caused the crash minutes after the process died.

Write a C program that mimics loading a coredump in GDB: classify faulting addresses against a memory region table, then reconstruct a backtrace by walking the saved-RBP chain from a stack dump.

Requirements:

• Parse a region table (name, start address, size, all hex) and print for each fault address "fault 0xADDR: NAME", or "fault 0xADDR: ??" when the address falls in no region
• Parse a stack-slot table of "address value" pairs (a tiny core memory image, duplicates allowed - use the FIRST occurrence when reading)
• Starting from the given RBP, walk the frame chain up to 4 frames: read saved_rbp at RBP and the return address at RBP+8; if either word is missing from the stack table print "frame F: rbp 0xADDR unmapped" (or "... ret unmapped") and stop
• Print "frame F: rbp=0xRBP ret=0xRET" for each unwound frame; stop when the saved RBP is 0