4

I am debugging a crash using GDB and a core file. A large portion of the memory space is mmapped into the process. That portion of the memory is not saved into the core file. I have a file that contains all the data in that mmapped memory.

I would like to find a way to load the data from that file into GDB at a certain offset so that I can display datastructures within that address space. Is this possible?

Note that I have tried the 'restore' command in GDB but it only works when debugging a running process.

Perhaps there are tools that allow a core file to have additional data appended to it? I am experimenting with objcopy to see if I can augment the core file with this binary data, but I have not been successful yet.

3 Answers 3

2

The only way that I was able to get this to work was to modify the core file itself to have an additional program header/section that contained the new data.

In theory, I believe that objcopy should be able to do this, but after a lot of testing I was unable to get it to work. Instead, I resorted to writing a perl script that modified the core file.

Here is the script for those of you stuck in a similar situation (note that this is for ELF core files on an i386 arch):

#!/usr/bin/perl

my @elfHeader = (
  [ident => 'A16'],
  [e_type => 'v'],
  [e_machine => 'v'],
  [e_version => 'V'],
  [e_entry => 'V'],
  [e_phoff => 'V'],
  [e_shoff => 'V'],
  [e_flags => 'V'],
  [e_ehsize => 'v'],
  [e_phentsize => 'v'],
  [e_phnum => 'v'],
  [e_shentsize => 'v'],
  [e_shnum => 'v'],
  [e_shstrndx => 'v']
);

my @progHeader = (
  [ptype => 'V'],
  [poffset => 'V'],
  [pvaddr => 'V'],
  [ppaddr => 'V'],
  [pfilesz => 'V'],
  [pmemsz => 'V'],
  [pflags => 'V'],
  [palign => 'V'],
);


my ($core, $dataFile, $outFile) = @ARGV;

main();


sub main {

  my @stat = stat($core);
  my $coreSize = $stat[7];

  @stat = stat($dataFile);
  my $dfSize = $stat[7];

  my ($in, $out, $df);
  open($in, "", $outFile) || die("Couldn't open $outFile: $!");

  my $buf;
  my $bytes = sysread($in, $buf, 52);

  my $hdr = unpackStruct(\@elfHeader, $buf);

  # Fix the elf header to have an additional program header
  my $phNum = $hdr->{e_phnum};
  $hdr->{e_phnum}++;

  # Fix the header to point to a new location for the program headers (at the end of the file)
  my $phOff = $hdr->{e_phoff};
  $hdr->{e_phoff} = $coreSize;

  # Read in the full program header table
  my $phTable;
  sysseek($in, $phOff, 0);
  my $readSize = $hdr->{e_phentsize} * $phNum;
  $bytes = sysread($in, $phTable, $readSize);

  # Add an additional entry to the end of the ph table
  my $entry = packStruct(\@progHeader, {ptype => 1, 
                                        poffset => $coreSize + $hdr->{e_phentsize} * $hdr->{e_phnum},
                                        pvaddr => 0x80f95000,
                                        ppaddr => 0,
                                        pfilesz => $dfSize,
                                        pmemsz => $dfSize,
                                        pflags => 7,
                                        palign => 4096});

  $phTable .= $entry;

  # Form the new elf header
  my $elf = packStruct(\@elfHeader, $hdr);

  # Output the new header
  syswrite($out, $elf, length($elf));

  # Copy the full core file after the header
  sysseek($in, 52, 0);
  copyData($in, $out, $coreSize - 52);

  # Output the new program table
  syswrite($out, $phTable, length($phTable));

  # Add the data on the end
  copyData($df, $out, $dfSize);

}


sub copyData {
  my ($in, $out, $numBytes) = @_;

  my $buf;

  while ($numBytes > 0) {
    my $readBytes = sysread($in, $buf, 8192);
    syswrite($out, $buf, $readBytes);
    $numBytes -= $readBytes;
  }

}


sub unpackStruct {
  my ($fields, $data) = @_;

  my $unpack;
  map {$unpack .= $_->[1]} @{$fields};

  my @vals = unpack($unpack, $data);

  my %res;
  foreach my $field (@{$fields}) {
    $res{$field->[0]} = shift(@vals);
  }

  return \%res;

}


sub packStruct {
  my ($fields, $data) = @_;

  my $pack;
  map {$pack .= $_->[1]} @{$fields};

  my @vals;
  foreach my $field (@{$fields}) {
    push(@vals, $data->{$field->[0]})
  }

  my $res = pack($pack, @vals);

  return $res;

}
2

Can you use restore binary?

http://sourceware.org/gdb/current/onlinedocs/gdb/Dump_002fRestore-Files.html#Dump_002fRestore-Files

0

As far as I know, gdb works either on a core file or a running process. What you seem to be describing is a hybrid: running a core file. I don't think that's possible, and the gdb documentation suggests there are no other choices.

1
  • Sorry if I was not clear: I am just using a core file, but the system was not setup to save the mmapped parts of memory. This memory is mmapped because it a large chunk of physically mapped contiguous RAM. After the crash occurred, that part of RAM was saved to a file. I want to load that file into GDB so that I don't have to manually map that data to datastructures. objcopy to augment the core file looks promising, but I haven't gotten it to work yet.
    – efunneko
    May 26, 2010 at 1:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.