gdbcoredumppostmortem-debugging

Unwind known stack and instruction pointer with GDB


I have a core dump on Linux x64. At some point SIGSEGV happened and unfortunately application handled this signal (but still failed in the end). So core dump doesn't directly contain frames of original SIGSEGV.

I was able to determine SP and IP (and other registers as well) of a failed instruction. Basically I have full ucontext structure.

Is there a way with GDB/LLDB instead of showing stacks on threads just unwind the backtrace from known SP/IP ?


Solution

  • Is there a way with GDB/LLDB instead of showing stacks on threads just unwind the backtrace from known SP/IP ?

    The RSP and RIP are necessary, but not sufficient: you also need to know the contents of stack at the point of crash.

    It sounds from your description that your signal handler attempted to recover from from this crash (perhaps by siglongjmping out), in which case the stack was unwound and its contents is probably gone.

    It that is not the case, you may be able to unwind the stack by hand, but (as far as I know) GDB doesn't have any support for doing this. You'll have to examine unwind descriptors (readelf -wf a.out) and perform the necessary register restore operations by hand.

    If your binary was built with frame pointers (this is not the default on x86_64 in optimized builds), this is much easier: you'll only need to restore RBP and then follow frame pointer chain.