Re: How to make a core dump?

Le Sat, Sep 04, 2004 at 01:49:24PM +0400, Alexander Morozov a écrit:
> Hello everyone,
> recently my friend have found a malcious program running on his
> web-server. After some actions i thought it would be helpful to make
> its core dump, but i couldn't figure out how to do this. The only
> thing that came to mind was attaching to it with gdb, stopping
> it and dumping regions of memory manually (using memory map in
> /proc/pid/mem). It went fine, i copied all segments but it would be much
> better to have standart core dump, to be able to use usual programms on
> it later. I remember, that several years ago default behaviour of a
> program running under linux was dumping itself on SIGSEGV.
> And I wonder, how was this fullfilled, was it feature of glibc to catch
> SIGV and write a dump? Or was it made by the kernel?
> 
> Alexander Morozov

[binarym@trait-plat]:/tmp% ls
gconfd-binarym  orbit-binarym
[binarym@trait-plat]:/tmp% cat
---- ON ANOTHER TERMINAL ---
[binarym@trait-plat]:~% ps aux | grep cat
binarym    880  0.0  0.1  1516  340 pts/1    S+   07:01   0:00 cat
[binarym@trait-plat]:~% kill -SEGV 880
---- BACK TO THE FIRST TERMINAL ---
zsh: segmentation fault (core dumped)  cat
[binarym@trait-plat]:/tmp% ls
core  gconfd-binarym  orbit-binarym
[binarym@trait-plat]:/tmp%

Don't forget the ulimit -c unlimited if you want the core to be generated.

-- 
Gérald Colangelo

list at psycho-hazard dot net
http://psycho-hazard.net/~binarym/