Analyze a Coredump Post-Mortem

Core Dump Analysis

When a program crashes with a segmentation fault, the operating system can generate a core dump file containing the memory image of the process at the time of crash. This enables post-mortem debugging when you cannot reproduce the crash interactively.

Generating and Analyzing Core Dumps

Enable core dumps:

• ulimit -c unlimited: Allow unlimited core file size
• echo core.%e.%p > /proc/sys/kernel/core_pattern: Set naming pattern

Analyze with GDB:

cCopy
Loading…

For example, a SIGSEGV (signal 11) backtrace might show #0 0x00007fff... in trigger_segfault () with $rip pointing at a NULL pointer dereference.

For This Exercise

You will document how to generate and analyze a core dump after a segmentation fault. Understanding post-mortem debugging is critical for investigating production crashes where the process cannot be restarted under a live debugger.

Reading Crash State

After loading the core, bt full shows local variables at each frame. Examine $rip to find the faulting instruction and x/10x $rsp to inspect stack contents. A NULL pointer dereference shows $rip in a low address range and info registers reveals zero in the source register. Core dumps preserve the entire memory image, so you can inspect heap allocations that caused the crash minutes after the process died.