Core dumps

A core dump is a snapshot of the execution of a program at the moment it is aborted by the operating system (e.g. for attempting to violate the memory protection). A normal core dump is not very helpful unless you are an expert. In the section called The debugger, we will see how to make core dumps more helpful for debugging.

By default, core dumps do not contain all the information you'd like them to. For example, a core dump can tell you that you where dereferencing a pointer at memory location 0x12345 while executing the instruction at 0x45678. You'd probably like to see a message that means more to you (`The program was aborted while attempting to dereference foo, which was NULL, at bar.c line 23'). This is possible, but it requires you to include such information in advance.

Also, note that a core dump is a snapshot; it does not include the history of how your program came to the problematic state. What a core dump shows you is a manifestation of a bug; the point where a program dumps core is not always the location of the bug itself, which may be located 100000 instructions back in time. Often, you can reconstruct the history of a run from a core dump, but this is difficult. printf debugging (see the section called printf() debugging) and possibly system call tracing (see the section called System call tracers) are useful techniques to do this. Using a debugger (see the section called The debugger) is advised.