== DEBUGGING CORE FILES [01] == WHAT IS A CORE FILE?

Body

== DEBUGGING CORE FILES [01] == WHAT IS A CORE FILE?

A core file is the (almost complete) image of the running process in memory.

Core files can be created on demand using gencore, gcore or other commands
but most of the time they are the result of a fault in the executing program.
They are useful for finding what was wrong at the time a process crashed
because they provide us with access to most of the data that the program
was using when it crashed.

While the internal format of a core file will depend based on the machine
you are working on (ELF/XCOFF) the organization of the file itself is
very similar. It contains some blocks that are copies of various memory
regions used by the process and some headers for a debugger or a C program
to navigate the file. It will also contain a few extra structures that
contain various information about the user, process and threads.

The following image shows the layout of a process and what the corresponding
core file would contain. Note that the order of regions will vary depending
on he platform you are running on. The same applies to the core file,
the layout will depend on the format (ELF/XCOFF).

We can see various regions. The 'text' sections contain the instructions that
are executed. The 'data' sections contain global, static variables as well
as relocation tables and so on. The 'stack', the 'heap' as well as possible
'anon' (anonymous mmap) and shared memory regions. Note that the core file
will omit some regions like the 'text' ones which is why it is always
important to provide the executable as well as the shared libraries or other
objects that the executable was using at the time the core file was
generated.