Search code examples
debugginggdbcoredump

Is there a generic format for core files?


I've noticed that no matter which compiler I use (gcc, llvm, clang, icc, etc.), if I get a core dump, I can almost always just throw it into GDB (or probably other debuggers, but I end up with GDB reflexively most of the time) without worrying about how the program/library was compiled. Why is this? Is there a generic format to describe how core dumps are created? Are there any compiler/debugger combos that don't follow this format?


Solution

  • Core dump files are written by the operating system kernel and not by the compiler or debugger. That's why for e.g. every Linux debugger supports the same format.

    Linux core dumps use the ELF format. The kernel side implementation is in elf_core_dump() in fs/binfmt_elf.c.

    There are, however, crash-reporting systems like Crashpad that write out their own core dump equivalents for remote collection. These dumps are much smaller, can include only a list of stack trace addresses and use their own custom format across different operating systems. You'd need to explicitly integrate these as libraries in your apps though.