I used gdb to produce core dump file with gcore and used the dump in symbolic execution. However I found it did not include read-only segments in memory, for example, the loaded library libc.so.6. Unfortunately, I need it for symbolic execution.
Is there a way to make core dump also include those read-only segments?
EDIT:
I changed value in /proc//coredump_filter to 0x3c to allow:
" Dump file-backed shared mappings" according to core(5). However, gcore now gives dozens of warnings:
warning: Memory read failed for corefile section, 1048576 bytes at xxxxxx
,where xxxxxx is roughly the memory region where shared libraries (including libc, etc.) lies in the memory. However I want the core file to include shared libraries.
What is wrong?
ps: I can read from memory regions of shared libraries inside gdb normally with a plain gdb command x /16i.
EDIT:
I also checked /proc/<pid>/smaps, inside which, for example, memory region of libc is like:
7f65930f8000-7f65932df000 r-xp 00000000 08:01 789499 /lib/x86_64-linux-gnu/libc-2.27.so
Size: 1948 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 836 kB
Pss: 82 kB
Shared_Clean: 836 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 0 kB
Referenced: 836 kB
Anonymous: 0 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
VmFlags: rd ex mr mw me sd
I presume the default value 0x33 in coredump_filter should be sufficient to dump this region.
Also as VM flags do not include dd (do not include area into core dump), it was not prevented from being written to core file, but why gcore did not dump it???