Question

gcc generally embeds a build ID into shared objects to allow symbols — and the shared object itself — to be automatically retrieved. The scheme is documented here:

http://fedoraproject.org/wiki/Releases/FeatureBuildId

I have a user-mode core dump that I want to analyze and I know, based on the article above, that it very likely contains the build IDs for all of the shared objects that I care about (a couple of dozen in total). If I could extract the build IDs from the core dump then I could find the correct versions in our archives and be able to debug this core dump (and future core dumps).

The core dump comes from another machine which I do not have access to and I can’t trust the user on that machine to give me additional information about what modules are on that machine.

So… any idea what gdb commands or read-elf magic will find me these build IDs?

Answer 1

You can extract the build id with eu-unstrip, which is part of elfutils:

$ eu-unstrip -n --core core-file
0x8048000+0x25d000 b7fada8ba917de74a6055647f3ac205dee1615c8@0x8048178 - - [exe]
0xb7790000+0x1000 da7bd9bbfe599f7e9b644d684db983c4b34d8f31@0xb77901ec . - linux-gate.so.1
0xb7771000+0x19000 242ae1f2965ed161f3715858d7792019963b57fd@0xb7771164 /lib/i686/cmov/libpthread.so.0 - libpthread.so.0
0xb7768000+0x9000 06a49519b1ede0f79596e4b0cd07d2beba43b2dc@0xb7768164 /lib/i686/cmov/librt.so.1 - librt.so.1
0xb7672000+0xf5000 9daf5aac9ccc9281f2805639c3f87731beae5548@0xb7672144 /usr/lib/libstdc++.so.6 - libstdc++.so.6
0xb764c000+0x26000 696d5fb148fe51609203903d470a8f85d458cd17@0xb764c164 /lib/i686/cmov/libm.so.6 - libm.so.6
0xb762e000+0x1e000 d2a7edbd5dafabb7bb90198eeb58013342c589f0@0xb762e104 /lib/libgcc_s.so.1 - libgcc_s.so.1
0xb74e7000+0x147000 2124040143ac9f7478cc16b474b1cfdfe2c45353@0xb74e7184 /lib/i686/cmov/libc.so.6 - libc.so.6
0xb7791000+0x1d000 5a6fc3cf12f68887cbf22da3a9785d00f7d91c41@0xb7791124 /lib/ld-linux.so.2 - ld-linux.so.2