Is it possible to load a file full of binary data into GDB when GDB is debugging a core file?

Question

I am debugging a crash using GDB and a core file. A large portion of the memory space is mmapped into the process. That portion of the memory is not saved into the core file. I have a file that contains all the data in that mmapped memory.

I would like to find a way to load the data from that file into GDB at a certain offset so that I can display datastructures within that address space. Is this possible?

Note that I have tried the 'restore' command in GDB but it only works when debugging a running process.

Perhaps there are tools that allow a core file to have additional data appended to it? I am experimenting with objcopy to see if I can augment the core file with this binary data, but I have not been successful yet.

Answer 1

As far as I know, gdb works either on a core file or a running process. What you seem to be describing is a hybrid: running a core file. I don't think that's possible, and the gdb documentation suggests there are no other choices.

Answer 2

The only way that I was able to get this to work was to modify the core file itself to have an additional program header/section that contained the new data.

In theory, I believe that objcopy should be able to do this, but after a lot of testing I was unable to get it to work. Instead, I resorted to writing a perl script that modified the core file.

Here is the script for those of you stuck in a similar situation (note that this is for ELF core files on an i386 arch):

#!/usr/bin/perl

my @elfHeader = (
  [ident => 'A16'],
  [e_type => 'v'],
  [e_machine => 'v'],
  [e_version => 'V'],
  [e_entry => 'V'],
  [e_phoff => 'V'],
  [e_shoff => 'V'],
  [e_flags => 'V'],
  [e_ehsize => 'v'],
  [e_phentsize => 'v'],
  [e_phnum => 'v'],
  [e_shentsize => 'v'],
  [e_shnum => 'v'],
  [e_shstrndx => 'v']
);

my @progHeader = (
  [ptype => 'V'],
  [poffset => 'V'],
  [pvaddr => 'V'],
  [ppaddr => 'V'],
  [pfilesz => 'V'],
  [pmemsz => 'V'],
  [pflags => 'V'],
  [palign => 'V'],
);


my ($core, $dataFile, $outFile) = @ARGV;

main();


sub main {

  my @stat = stat($core);
  my $coreSize = $stat[7];

  @stat = stat($dataFile);
  my $dfSize = $stat[7];

  my ($in, $out, $df);
  open($in, "", $outFile) || die("Couldn't open $outFile: $!");

  my $buf;
  my $bytes = sysread($in, $buf, 52);

  my $hdr = unpackStruct(\@elfHeader, $buf);

  # Fix the elf header to have an additional program header
  my $phNum = $hdr->{e_phnum};
  $hdr->{e_phnum}++;

  # Fix the header to point to a new location for the program headers (at the end of the file)
  my $phOff = $hdr->{e_phoff};
  $hdr->{e_phoff} = $coreSize;

  # Read in the full program header table
  my $phTable;
  sysseek($in, $phOff, 0);
  my $readSize = $hdr->{e_phentsize} * $phNum;
  $bytes = sysread($in, $phTable, $readSize);

  # Add an additional entry to the end of the ph table
  my $entry = packStruct(\@progHeader, {ptype => 1, 
                                        poffset => $coreSize + $hdr->{e_phentsize} * $hdr->{e_phnum},
                                        pvaddr => 0x80f95000,
                                        ppaddr => 0,
                                        pfilesz => $dfSize,
                                        pmemsz => $dfSize,
                                        pflags => 7,
                                        palign => 4096});

  $phTable .= $entry;

  # Form the new elf header
  my $elf = packStruct(\@elfHeader, $hdr);

  # Output the new header
  syswrite($out, $elf, length($elf));

  # Copy the full core file after the header
  sysseek($in, 52, 0);
  copyData($in, $out, $coreSize - 52);

  # Output the new program table
  syswrite($out, $phTable, length($phTable));

  # Add the data on the end
  copyData($df, $out, $dfSize);

}


sub copyData {
  my ($in, $out, $numBytes) = @_;

  my $buf;

  while ($numBytes > 0) {
    my $readBytes = sysread($in, $buf, 8192);
    syswrite($out, $buf, $readBytes);
    $numBytes -= $readBytes;
  }

}


sub unpackStruct {
  my ($fields, $data) = @_;

  my $unpack;
  map {$unpack .= $_->[1]} @{$fields};

  my @vals = unpack($unpack, $data);

  my %res;
  foreach my $field (@{$fields}) {
    $res{$field->[0]} = shift(@vals);
  }

  return \%res;

}


sub packStruct {
  my ($fields, $data) = @_;

  my $pack;
  map {$pack .= $_->[1]} @{$fields};

  my @vals;
  foreach my $field (@{$fields}) {
    push(@vals, $data->{$field->[0]})
  }

  my $res = pack($pack, @vals);

  return $res;

}

Answer 3

Can you use restore binary?

http://sourceware.org/gdb/current/onlinedocs/gdb/Dump_002fRestore-Files.html#Dump_002fRestore-Files