how to read the content of cpu registers from a core dump file

Question

I wrote the following C programm

#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>

void main(){

  char *variable = "CodeName0...";
  while (1){
    
    printf("%s\n%d\n","hello from gencore code source",getpid());

    sleep(2);
  }
  exit(0);
}

after running it I sent a SIGABRT signal using the following command kill -6 <process Id from code execution>

this generated a core dump file under the name core inside the same directory

I want to read the content of cpu registers ( IP ... ) but I didn't manage to do it

I'm runnig parrot OS, this is the output of uname -a

Linux Parrot 5.16.0-12parrot1-amd64 #1 SMP PREEMPT Debian 5.16.12-2parrot1 (2022-03-11) x86_64 GNU/Linux

I tried using gdb but I'm getting this error

"0x7fffd7f6de10s": not in executable format: file format not recognized

I would like to know why this is the case ( file format not recognized )

I use `coredumpctl` so for me it was just `coredumpctl debug` and then it started `gdb` just fine and `info all-registers` showed all registers. How did you do it? — Ted Lyngmo, Jan 11 '23 at 16:32
@EugeneSh I ran `gdb core` I believe I was doing it wrong. does gdb take the state of the program execution as an argument? — Djebarra Rabah Abderrazak, Jan 11 '23 at 16:50
You could search and find out it quite easily. https://stackoverflow.com/questions/5115613/core-dump-file-analysis — Eugene Sh., Jan 11 '23 at 16:52
@TedLyngmo I'm not able to install systemd-coredump on my system because of dependencies problem, I'm getting `systemd-coredump : Depends: systemd (= 247.3-7+deb11u1) but 251.3-1~bpo11+1 is to be installed` where can I find the ` systemd 247.3-7+deb11u1` package? — Djebarra Rabah Abderrazak, Jan 11 '23 at 16:52

score 0 · Accepted Answer · answered Jan 12 '23 at 02:07

Not really sure how to explain it any further:

$ gdb <binary> <core>
i all-registers

where <binary> is your binary, ideally compiled with -g3, and <core> is your core file that was dumped. You may need to navigate to different frame (bt and f <number> where <number> is the frame number). all-registers is a little verbose but here is i register output:

rax            0xfffffffffffffdfc  -516
rbx            0xffffffffffffff80  -128
rcx            0x7fa81f0c650a      140360052139274
rdx            0x7ffc19fe2020      140720744570912
rsi            0x0                 0
rdi            0x0                 0
rbp            0x0                 0x0
rsp            0x7ffc19fe1fe0      0x7ffc19fe1fe0
r8             0x0                 0
r9             0x27                39
r10            0x7ffc19fe2020      140720744570912
r11            0x246               582
r12            0x562d5cc38070      94752829833328
r13            0x0                 0
r14            0x0                 0
r15            0x0                 0
rip            0x7fa81f0c650a      0x7fa81f0c650a <__GI___clock_nanosleep+42>
eflags         0x246               [ PF ZF IF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

how to read the content of cpu registers from a core dump file

1 Answers1