Generation and debugging method of Coredump under Linux

What is Coredump

Typically, COREDMP includes memory, register status, stack pointers, memory management information, etc. when the program executes. Can be understood to store the current state of the program's work as a file. Many programs and operating systems fail to generate a core file on their own.

How to use Coredump

Coredump can be used on a very large number of occasions, using Linux, or Solaris people may have had this experience, the system is running some pressure test or system load, the system will hang or simply Panic. The only thing that can help you analyze and solve this problem is coredump.

There are a lot of coredump that should happen when the program goes wrong.

Tools for analyzing Coredump

Most Unix-like operating systems today provide tools for analyzing core files, such as the GNU Binutils Binary File Descriptor Library (BFD), GNU Debugger (GDB) ,mdb , etc.

File formats for Coredump

The Coredump file is saved in the Unix-like operating system using the EFI format.

Under the Solairs

bash-3.2# file *unix.3 ELF 32-bit LSB executable 80386 Version 1, statically linked, not stripped, no debugging informatio n availableunix.4 ELF 32-bit LSB executable 80386 Version 1, statically linked, not stripped, no debugging information Ava Ilable

There are many reasons for the coredump of the program, which is based on previous experience:

1 memory access out of bounds
A) array access is out of bounds due to incorrect subscript
b) When searching for a string, rely on the string terminator to infer whether the string ends, but the string does not have a normal use terminator
c) Use strcpy, strcat, sprintf, strcmp, strcasecmp and other string manipulation functions, the target string read/write burst. You should use strncpy, strlcpy, Strncat, Strlcat, snprintf, strncmp, strncasecmp, and other functions to prevent read and write out of bounds.

2 multithreaded threads use a thread-unsafe function.
The following reentrant functions should be used, with particular attention to the red-labeled functions, which are very easy to use incorrectly:
Asctime_r (3c) Gethostbyname_r (3n) getservbyname_r (3n) ctermid_r (3s) gethostent_r (3n) getservbyport_r (3n) Ctime_r (3c) Getlogin_r (3c) Getservent_r (3n) Fgetgrent_r (3c) Getnetbyaddr_r (3n) Getspent_r (3c) Fgetpwent_r (3c) Getnetbyname_r (3n) Getspnam_r (3c) Fgetspent_r (3c) Getnetent_r (3n) Gmtime_r (3c) Gamma_r (3m) Getnetgrent_r (3n) lgamma_r (3m) Getauclassent_ R (3) Getprotobyname_r (3n) Localtime_r (3c) Getauclassnam_r (3) etprotobynumber_r (3n) nis_sperror_r (3n) Getauevent_r (3) Getprotoent_r (3n) Rand_r (3c) Getauevnam_r (3) Getpwent_r (3c) Readdir_r (3c) Getauevnum_r (3) Getpwnam_r (3c) Strtok_r (3c) Getgrent_r (3c) Getpwuid_r (3c) Tmpnam_r (3s) getgrgid_r (3c) Getrpcbyname_r (3n) Ttyname_r (3c) Getgrnam_r (3c) Getrpcbynumber_r (3n) gethostbyaddr_r (3n) getrpcent_r (3n)

3 multi-thread read-write data is not locked for protection.
For global data that will be visited by multiple threads at the same time, you should pay attention to lock protection, otherwise very easy causes core dump

4 illegal pointers
A) use a null pointer
b) Arbitrarily use pointer conversions. A pointer to a piece of memory, unless it is determined that the memory was originally assigned to a struct or type, or an array of such a structure or type, do not convert it to such a struct or type of pointer, but should copy this memory into one such structure or type, and then visit this structure or type. This is due to the assumption that the start address of this memory is not aligned according to such structure or type, then access to it is very easy due to bus error and core dump.

5 Stack Overflow
Do not use large local variables (because local variables are allocated on the stack) so that easy causes a stack overflow, destroys the stack and heap structure of the system, and causes inexplicable errors to occur.

How to generate coredump files and how to use them:

(if the following example is x86 on the cross-compilation, while the Arm the behavior of the exception is performed)

1. in Span lang= "en-US" >arm kernel add? coredump support (general kernel supports coredump, no renumbering)

< Span lang= "en-US" style= "Color:blue" >2. Execute the command at this time agree Span lang= "en-US" >coredump File generation: ( In arm on ) br> ulimit–c unlimited

3. Running the program: ( on arm )
./test
when an exception exits, a demo sample is shown, such as the following information, noting the contents of parentheses
Segmentation Fault (core dumped)
*core file will be generated under Program Run folder

4. using gdb to analyze: ( on x86 )
Arm-linux-gdb./test Test.core
and then use gdb 's bt or where to see it.
(arm-linux-gdb compilation See < Debug Tool four gdbserve>)

The system supports generating the core and setting the storage location method:

1>/etc/profile in the following line, which will agree to generate Coredump file
Ulimit-c Unlimited

2> in rc.local? The following line, which causes the program to crash when the generated Coredump file is located in the/tmp folder:
echo/tmp/core.%e.%p >/proc/sys/kernel/core_pattern

/tmp/can also be a different folder location. The best location should meet the following requirements:
* Written to all users
* Space capacity is large enough
* The file is not lost after power-down