IBM Support

== DEBUGGING CORE FILES [01] == WHAT IS A CORE FILE?

Technical Blog Post


Abstract

== DEBUGGING CORE FILES [01] == WHAT IS A CORE FILE?

Body

== DEBUGGING CORE FILES [01] == WHAT IS A CORE FILE?

A core file is the (almost complete) image of the running process in memory.

Core files can be created on demand using gencore, gcore or other commands
but most of the time they are the result of a fault in the executing program.
They are useful for finding what was wrong at the time a process crashed
because they provide us with access to most of the data that the program
was using when it crashed.

While the internal format of a core file will depend based on the machine
you are working on (ELF/XCOFF) the organization of the file itself is
very similar. It contains some blocks that are copies of various memory
regions used by the process and some headers for a debugger or a C program
to navigate the file. It will also contain a few extra structures that
contain various information about the user, process and threads.

The following image shows the layout of a process and what the corresponding
core file would contain. Note that the order of regions will vary depending
on he platform you are running on. The same applies to the core file,
the layout will depend on the format (ELF/XCOFF).

Process virtual space
Core file
PROGRAM TEXT COREDUMP HEADER
PROGRAM DATA COREDUMP EXTRA HEADERS
HEAP PROGRAM DATA
SHARED MEMORY SEGMENT 1 HEAP
STACK FOR THREAD 1 SHARED MEMORY SEGMENT 1
SHARED LIBRARY 1 TEXT STACK FOR THREAD 1
SHARED LIBRARY 1 DATA SHARED LIBRARY 1 DATA
SHARED LIBRARY 2 TEXT SHARED LIBRARY 2 DATA
SHARED LIBRARY 2 DATA STACK
STACK ADDITIONAL INFO

We can see various regions. The 'text' sections contain the instructions that
are executed. The 'data' sections contain global, static variables as well
as relocation tables and so on. The 'stack', the 'heap' as well as possible
'anon' (anonymous mmap) and shared memory regions. Note that the core file
will omit some regions like the 'text' ones which is why it is always
important to provide the executable as well as the shared libraries or other
objects that the executable was using at the time the core file was
generated.

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSEPGG","label":"DB2 for Linux- UNIX and Windows"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

UID

ibm11140250