Editing Core dump (section)

== Core-dump files ==

=== Format ===

In older and simpler operating systems, each process had a contiguous address-space, so a dump file was sometimes simply a file with the sequence of bytes, digits,{{efn|name=decimal|Some older machines were [[Decimal computer|decimal]].}} characters{{efn|name=decimal}} or words. On other systems a dump file contained discrete records, each containing a storage address and the associated contents. On the earliest of these machines, the dump was often written by a stand-alone dump program rather than by the application or the operating system.

<!-- I doubt that this was first; please add older examples if you know of any. -->
The [[IBSYS]] monitor for the [[IBM 7090]] included a System Core-Storage Dump Program<ref>{{cite book
 | title       = IBM 7090/7094 IBSYS Operating System - Version 13 - System Monitor (IBSYS)
 | id          = C28-6248-7
 | date        = December 30, 1966
 | edition     = Eighth
 | section     = System Core-Storage Dump Program
 | section-url = http://bitsavers.org/pdf/ibm/7090/C28-6248-7_v13_IBSYS_Dec66.pdf#page=18
 | pages       = 18–20
 | url         = http://bitsavers.org/pdf/ibm/7090/C28-6248-7_v13_IBSYS_Dec66.pdf
 | publisher   = [[IBM]]
 | series      = Systems Reference Library
 | access-date = May 10, 2024
 }}
</ref> that supported post-mortem and snap dumps.

On the [[IBM System/360]], the standard operating systems wrote formatted ABEND and SNAP dumps, with the addresses, registers, storage contents, etc., all converted into printable forms. Later releases added the ability to write unformatted{{efn|In the sense that the records were binary rather than formatted for printing.}} dumps, called at that time core image dumps (also known as SVC dumps.)

In modern operating systems, a process address space may contain gaps, and it may share pages with other processes or files, so more elaborate representations are used; they may also include other information about the state of the program at the time of the dump.

In [[Unix-like]] systems, core dumps generally use the standard [[executable]] image-[[file format|format]]:
* [[a.out]] in older versions of [[Unix]],
* [[Executable and Linkable Format|ELF]] in modern [[Linux]], [[UNIX System V|System V]], [[Solaris (operating system)|Solaris]], and [[BSD]] systems,
* [[Mach-O]] in [[macOS]], ''etc.''

=== {{Anchor|VMCORE}}Naming ===
==== OS/360 and successors ====
In [[OS/360 and successors]], a job may assign arbitrary data set names (dsnames) to the ddnames <code>SYSABEND</code> and <code>SYSUDUMP</code> for a formatted ABEND dump and to arbitrary ddnames for SNAP dumps, or define those ddnames as SYSOUT.{{efn|SYStem OUTput files (SYSOUT) files are temporary files owned by the [[Spooling|SPOOL]] software.}} The Damage Assessment and Repair (DAR) facility added an automatic unformatted{{efn|IBM provided tools for extracting and formatting data from an unformatted dump; those tools{{efn|Initially the batch utility IMDPRDMP; currently the TSO command and [[ISPF]] panel repertoire for Interactive Problem Control System (IPCS).}} often made it easier to deal with an unformatted dump than a formatted dump.}} storage dump to the dataset <code>SYS1.DUMP</code>{{efn|Since then, IBM added the ability to have up to a hundred dump datasets named <code>SYS1.DUMPnn</code> (nn from 00 to 99). [[z/OS]] supports multiple system dump data sets with arbitrary dsname patterns under installation and operator<ref>{{cite manual
 | title       = z/OS 2.5 MVS System Commands
 | id          = SA38-0666-50
 | date        = March 25, 2022
 | pages       = 474–475
 | section     = Setting the name-pattern for dump data sets
 | section-url = https://www.ibm.com/servers/resourcelink/svc00100.nsf/pages/zOSV2R5sa380666/$file/ieag100_v2r5.pdf#page=506
 | url         = https://www.ibm.com/servers/resourcelink/svc00100.nsf/pages/zOSV2R5sa380666/$file/ieag100_v2r5.pdf
 | access-date = April 6, 2022
 }}
</ref> control.}} at the time of failure as well as a console dump requested by the operator. A job may assign an arbitrary dsname to the ddname <code>SYSMDUMP</code> for an unformatted ABEND dump, or define that ddname as SYSOUT.{{efn|If SYSMDUMP is allocated, then no formatted dump is written to SYSABEND or SYSUDUMP.}} The newer transaction dump is very similar to the older SVC dump. The ''Interactive Problem Control System'' (IPCS), added to OS/VS2 by ''Selectable Unit'' (SU) 57<ref>{{cite manual
 | title       = OS/VS2 MVS Interactive Problem Control System (IPCS) System Information - SUID 5752-857
 | id          = GC34-2004-0
 | date        = March 1978
 | edition     = First
 | url         = http://bitsavers.org/pdf/ibm/370/OS_VS2/GC34-2004-0_OS_VS2_MVS_Interactive_Problem_Control_System_IPCS_System_Information_197803.pdf
 | publisher   = [[IBM]]
 | access-date = June 29, 2023
 }}
</ref><ref>{{cite manual
 | title       = OS/VS2 MVS Interactive Problem Control System User's Guide and Reference - SUID 5752-857
 | id          = GC34-2006-1
 | date        = October 1979
 | edition     = Second
 | url         = http://bitsavers.org/pdf/ibm/370/OS_VS2/GC34-2006-1_OSVS2_MVS_Interactive_Problem_Control_System_Users_Guide_and_Reference_2nd_ed_197910.pdf
 | publisher   = [[IBM]]
 | access-date = June 29, 2023
 }}
</ref> and part of every subsequent [[MVS]] release, can be used to interactively analyze storage dumps on [[DASD]]. IPCS understands the format and relationships of system control blocks, and can produce a formatted display for analysis. The current versions of IPCS allow inspection of active address spaces<ref>{{cite manual
 | title       = z/OS 2.5 - MVS Interactive Problem Control System (IPCS) Commands
 | id          = SA23-1382-50
 | date        = 2023-05-12
 | page        = [https://www.ibm.com/servers/resourcelink/svc00100.nsf/pages/zOSV2R5sa231382/$file/ieac500_v2r5.pdf#page=259 239]
 | quote       = ACTIVE, MAIN, or STORAGE specifies the central storage for the address space in which IPCS is currently running and allows you to access that active storage as the dump source. You can access private storage and any common storage accessible by an unauthorized program.
 | section     = SETDEF subcommand - set defaults
 | section-url = https://www.ibm.com/servers/resourcelink/svc00100.nsf/pages/zOSV2R5sa231382/$file/ieac500_v2r5.pdf#page=257
 | url         = https://www.ibm.com/servers/resourcelink/svc00100.nsf/pages/zOSV2R5sa231382/$file/ieac500_v2r5.pdf
 | publisher   = [[IBM]]
 | access-date = April 6, 2022
 }}
</ref>{{efn|With read authority to facility class BLSACTV.ADDRSPAC, IPCS can view any address space.}} without first taking a storage dump and of unformaated dumps on SPOOL.

==== Unix-like ====
Since Solaris&nbsp;8, system utility <code>coreadm</code> allows the name and location of core files to be configured. Dumps of user processes are traditionally created as <code>core</code>. On Linux (since versions 2.4.21 and 2.6 of the [[Linux kernel mainline]]), a different name can be specified via [[procfs]] using the <code>/proc/sys/kernel/core_pattern</code> configuration file; the specified name can also be a template that contains tags substituted by, for example, the executable filename, the process ID, or the reason for the dump.<ref>{{cite web
 | url = http://man7.org/linux/man-pages/man5/core.5.html
 | title = core(5) – Linux manual page
 | date = 2015-12-05
 | access-date = 2016-04-17
 | website = man7.org
 | archive-date = 2013-09-20
 | archive-url = https://web.archive.org/web/20130920151607/http://man7.org/linux/man-pages/man5/core.5.html
 | url-status = live
 }}</ref> System-wide dumps on modern Unix-like systems often appear as <code>vmcore</code> or <code>vmcore.incomplete</code>.

==== Others ====
Systems such as [[Microsoft Windows]], which use [[filename extension]]s, may use extension <code>.dmp</code>; for example, core dumps may be named <code>memory.dmp</code> or <code>\Minidump\Mini051509-01.dmp</code>.

=== Windows memory dumps ===
[[Microsoft Windows]] supports two memory dump formats, described below.

==== Kernel-mode dumps ====
{{Main article|Blue Screen of Death}}

There are five types of kernel-mode dumps:<ref>{{cite web|url=https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files|title=Varieties of Kernel-Mode Dump Files|publisher=Microsoft|access-date=22 February 2018|archive-date=22 February 2018|archive-url=https://web.archive.org/web/20180222165040/https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files|url-status=live}}</ref>
* Complete memory dump{{snd}} contains full physical memory for the target system.
* Kernel memory dump{{snd}} contains all the memory in use by the kernel at the time of the crash.
* Small memory dump{{snd}} contains various info such as the stop code, parameters, list of loaded device drivers, etc.
* Automatic Memory Dump (Windows 8 and later){{snd}} same as Kernel memory dump, but if the [[Paging#PAGEFILE-SYS|paging file]] is both System Managed and too small to capture the Kernel memory dump, it will automatically increase the paging file to at least the size of RAM for four weeks, then reduce it to the smaller size.<ref>{{Cite web|url=https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/automatic-memory-dump|title=Automatic Memory Dump|date=28 November 2017|publisher=Microsoft|language=en-us|access-date=16 March 2018|archive-date=17 March 2018|archive-url=https://web.archive.org/web/20180317102216/https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/automatic-memory-dump|url-status=live}}</ref>
* Active memory dump (Windows 10 and later){{snd}} contains most of the memory in use by the kernel and user mode applications.
To analyze the Windows kernel-mode dumps [[WinDbg|Debugging Tools for Windows]] are used, a set that includes tools like WinDbg & DumpChk.<ref>{{cite web|url=http://msdn.microsoft.com/en-us/library/windows/hardware/dn745912(v=vs.85).aspx|title=Getting Started with WinDbg (Kernel-Mode)|access-date=30 September 2014|archive-date=14 March 2016|archive-url=https://web.archive.org/web/20160314141124/https://msdn.microsoft.com/en-us/library/windows/hardware/dn745912(v=vs.85).aspx|url-status=live}}</ref><ref>{{cite web|url=https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windows-debugging|title=Get started with Windows debugging|access-date=14 December 2024}}</ref><ref>{{cite web|url=https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/extra-tools|title=Tools included in Debugging Tools for Windows
|access-date=14 December 2024}}</ref>

==== {{Anchor|MINIDUMP}}User-mode memory dumps ====
User-mode memory dump, also known as ''minidump'',<ref>{{cite web|url=http://msdn.microsoft.com/en-us/library/windows/desktop/ms680369(v=vs.85).aspx|title=Minidump Files|access-date=30 September 2014|archive-date=27 October 2014|archive-url=https://web.archive.org/web/20141027044054/http://msdn.microsoft.com/en-us/library/windows/desktop/ms680369(v=vs.85).aspx|url-status=live}}</ref> is a memory dump of a single process. It contains selected data records: full or partial (filtered) process memory; list of the [[Thread (computing)|threads]] with their [[call stack]]s and state (such as [[Processor register|registers]] or [[Win32 Thread Information Block|TEB]]); information about [[Handle (computing)|handles]] to the kernel objects; list of loaded and unloaded [[Dynamic-link library|libraries]]. Full list of options available in <code>MINIDUMP_TYPE</code> enum.<ref>{{cite web|url=http://msdn.microsoft.com/en-us/library/windows/desktop/ms680519(v=vs.85).aspx|title=MINIDUMP_TYPE enumeration|access-date=30 September 2014|archive-date=11 January 2015|archive-url=https://web.archive.org/web/20150111022428/http://msdn.microsoft.com/en-us/library/windows/desktop/ms680519(v=vs.85).aspx|url-status=live}}</ref>