Editing Core dump (section)

== Analysis ==
A core dump generally represents the complete contents of the dumped regions of the address space of the dumped process. Depending on the operating system, the dump may contain few or no data structures to aid interpretation of the memory regions. In these systems, successful interpretation requires that the program or user trying to interpret the dump understands the structure of the program's memory use.

A debugger can use a [[symbol table]], if one exists, to help the programmer interpret dumps, identifying variables symbolically and displaying source code; if the symbol table is not available, less interpretation of the dump is possible, but there might still be enough possible to determine the cause of the problem. There are also special-purpose tools called [[dump analyzer]]s to analyze dumps. One popular tool, available on many operating systems, is the GNU binutils' [[objdump]].

On modern [[Unix-like]] operating systems, administrators and programmers can read core dump files using the GNU Binutils [[Binary File Descriptor library]] (BFD), and the [[GNU Debugger]] (gdb) and objdump that use this library. This library will supply the raw data for a given address in a memory region from a core dump; it does not know anything about variables or data structures in that memory region, so the application using the library to read the core dump will have to determine the addresses of variables and determine the layout of data structures itself, for example by using the symbol table for the program undergoing debugging.

Analysts of crash dumps from [[Linux]] systems can use [[kdump (Linux)|kdump]] or the Linux Kernel Crash Dump (LKCD).<ref>{{cite book
|last= Venkateswaran
|first= Sreekrishnan
|title= Essential Linux device drivers
|url= https://books.google.com/books?id=Boo57V0IOq0C
|access-date= 2010-07-15
|series= Prentice Hall open source software development series
|year= 2008
|publisher= Prentice Hall
|isbn= 978-0-13-239655-4
|page= 623
|quote= Until the advent of kdump, ''Linux Kernel Crash Dump'' (LKCD) was the popular mechanism to obtain and analyze dumps.
|archive-date= 2014-06-26
|archive-url= https://web.archive.org/web/20140626201437/http://books.google.com/books?id=Boo57V0IOq0C
|url-status= live
}}</ref>

Core dumps can save the context (state) of a process at a given state for returning to it later. Systems can be made highly available by transferring core between processors, sometimes via core dump files themselves.

Core can also be dumped onto a remote host over a network (which is a security risk).<ref>{{cite book
|author= Fedora Documentation Project
|title= Fedora 13 Security Guide
|url= https://books.google.com/books?id=bh6LSvafC28C
|access-date= 2010-09-29
|year= 2010
|publisher= Fultus Corporation
|isbn= 978-1-59682-214-6
|page= 63
|quote= Remote memory dump services, like <code>netdump</code>, transmit the contents of memory over the network unencrypted.
|archive-date= 2014-06-26
|archive-url= https://web.archive.org/web/20140626201525/http://books.google.com/books?id=bh6LSvafC28C
|url-status= live
}}</ref>

Users of IBM mainframes running [[z/OS]] can browse SVC and transaction dumps using Interactive Problem Control System (IPCS), a full screen dump reader which was originally introduced in [[MVS#MVS/370|OS/VS2 (MVS)]], supports user written scripts in [[Rexx|REXX]] and supports point-and-shoot browsing{{efn|That is, you can position the cursor at a word or doubleword containing an address and request a display of the storage at that address.}} of dumps.