Analysis Methods

Coredump Mechanism

Coredump is a memory information capture mechanism based on asynchronous signals. It provides memory information mirroring in user mode for analysis. It is a common debugging method. Figure 1 shows the process.

Figure 1 Coredump work process

1. Some severe errors (such as invalid memory address access and invalid hardware instructions) occur during application execution. As a result, the kernel generates crash signals.
2. The signal processing function do_coredump checks whether the coredump condition is met, for example, whether the dumpable attribute of the current process is enabled.
3. If the conditions are met, create a core file and invoke the core_dump function to collect the onsite information about the current process.
4. Save the information in the core file in ELF format.