Is it possible to load a file full of binary data into GDB when GDB is debugging a core file?
I am debugging a crash using GDB and a core file. A large portion of the memory space is mmapped into the process. That portion of the memory is not saved into the core file. I have a file that contains all the data in that mmapped memory.
I would like to find a way to load the data from that file into GDB at a certain offset so that I can display datastructures within that address space. Is this possible?
Note that I have tried the 'restore
' command in GDB but it only works when debugging a running process.
Perhaps there are tools that allow a core file to have additio开发者_运维技巧nal data appended to it? I am experimenting with objcopy to see if I can augment the core file with this binary data, but I have not been successful yet.
The only way that I was able to get this to work was to modify the core file itself to have an additional program header/section that contained the new data.
In theory, I believe that objcopy should be able to do this, but after a lot of testing I was unable to get it to work. Instead, I resorted to writing a perl script that modified the core file.
Here is the script for those of you stuck in a similar situation (note that this is for ELF core files on an i386 arch):
#!/usr/bin/perl my @elfHeader = ( [ident => 'A16'], [e_type => 'v'], [e_machine => 'v'], [e_version => 'V'], [e_entry => 'V'], [e_phoff => 'V'], [e_shoff => 'V'], [e_flags => 'V'], [e_ehsize => 'v'], [e_phentsize => 'v'], [e_phnum => 'v'], [e_shentsize => 'v'], [e_shnum => 'v'], [e_shstrndx => 'v'] ); my @progHeader = ( [ptype => 'V'], [poffset => 'V'], [pvaddr => 'V'], [ppaddr => 'V'], [pfilesz => 'V'], [pmemsz => 'V'], [pflags => 'V'], [palign => 'V'], ); my ($core, $dataFile, $outFile) = @ARGV; main(); sub main { my @stat = stat($core); my $coreSize = $stat[7]; @stat = stat($dataFile); my $dfSize = $stat[7]; my ($in, $out, $df); open($in, "", $outFile) || die("Couldn't open $outFile: $!"); my $buf; my $bytes = sysread($in, $buf, 52); my $hdr = unpackStruct(\@elfHeader, $buf); # Fix the elf header to have an additional program header my $phNum = $hdr->{e_phnum}; $hdr->{e_phnum}++; # Fix the header to point to a new location for the program headers (at the end of the file) my $phOff = $hdr->{e_phoff}; $hdr->{e_phoff} = $coreSize; # Read in the full program header table my $phTable; sysseek($in, $phOff, 0); my $readSize = $hdr->{e_phentsize} * $phNum; $bytes = sysread($in, $phTable, $readSize); # Add an additional entry to the end of the ph table my $entry = packStruct(\@progHeader, {ptype => 1, poffset => $coreSize + $hdr->{e_phentsize} * $hdr->{e_phnum}, pvaddr => 0x80f95000, ppaddr => 0, pfilesz => $dfSize, pmemsz => $dfSize, pflags => 7, palign => 4096}); $phTable .= $entry; # Form the new elf header my $elf = packStruct(\@elfHeader, $hdr); # Output the new header syswrite($out, $elf, length($elf)); # Copy the full core file after the header sysseek($in, 52, 0); copyData($in, $out, $coreSize - 52); # Output the new program table syswrite($out, $phTable, length($phTable)); # Add the data on the end copyData($df, $out, $dfSize); } sub copyData { my ($in, $out, $numBytes) = @_; my $buf; while ($numBytes > 0) { my $readBytes = sysread($in, $buf, 8192); syswrite($out, $buf, $readBytes); $numBytes -= $readBytes; } } sub unpackStruct { my ($fields, $data) = @_; my $unpack; map {$unpack .= $_->[1]} @{$fields}; my @vals = unpack($unpack, $data); my %res; foreach my $field (@{$fields}) { $res{$field->[0]} = shift(@vals); } return \%res; } sub packStruct { my ($fields, $data) = @_; my $pack; map {$pack .= $_->[1]} @{$fields}; my @vals; foreach my $field (@{$fields}) { push(@vals, $data->{$field->[0]}) } my $res = pack($pack, @vals); return $res; }
Can you use restore binary
?
http://sourceware.org/gdb/current/onlinedocs/gdb/Dump_002fRestore-Files.html#Dump_002fRestore-Files
As far as I know, gdb
works either on a core file or a running process. What you seem to be describing is a hybrid: running a core file. I don't think that's possible, and the gdb documentation suggests there are no other choices.
精彩评论