I need to know how I can dump memory in Safari.app, to a file.
I've entered gdb attach 6741 (my safari PID).
I tried searching for help on gdb on google, but I couldn't find anything that told me what to do, even when searching for "how to dump memory in gdb" :(
I tried "help dump", it gave me a bunch of commands, but none of them worked. The closest I came was:
(gdb) dump memory ~/safaridump.bin 0 Missing stop address.
So whats the stop address? I don't know? How am I meant to know the stop address? I tried searching on google for ""missing stop address" gdb", it didn't help. I have no idea how I get the stop address.
I tried this:
(gdb) dump memory ~/safaridump.bin 0 0xffffffff
That didn't work either.
I got this:
gdb stack crawl at point of internal error: 0 gdb-i386-apple-darwin 0x0012fd8f internal_vproblem + 316 1 gdb-i386-apple-darwin 0x0012ffd3 internal_verror + 43 2 gdb-i386-apple-darwin 0x00130008 align_down + 0 3 gdb-i386-apple-darwin 0x00130a21 xstrvprintf + 0 4 gdb-i386-apple-darwin 0x00130c25 xmalloc + 40 5 gdb-i386-apple-darwin 0x000045d6 dump_memory_to_file + 241 6 gdb-i386-apple-darwin 0x0012dd3d execute_command + 713 7 gdb-i386-apple-darwin 0x0008815d command_handler + 213 8 gdb-i386-apple-darwin 0x000891af command_line_handler + 1120 9 gdb-i386-apple-darwin 0x001c2486 rl_callback_read_char + 137 10 gdb-i386-apple-darwin 0x000882ed rl_callback_read_char_wrapper + 18 11 gdb-i386-apple-darwin 0x000874b7 handle_file_event + 349 12 gdb-i386-apple-darwin 0x00086e7e process_event + 131 13 gdb-i386-apple-darwin 0x00087c38 gdb_do_one_event + 1178 14 gdb-i386-apple-darwin 0x00081bfd catch_errors + 78 /SourceCache/gdb/gdb-1346/src/gdb/utils.c:1208: internal-error: virtual memory exhausted. A problem internal to GDB has been detected, further debugging may prove unreliable. Quit this debugging session? (y or n) n
I really don't get this. All I want, is my memory in Safari, written to a file.
It's really important to me. I spent about 2 hours typing my poor heart out in Safari, writing some really important information down. And then the stupid website I was writing to, didn't accept my post, because I had taken so long writing it, that I had "signed out". By the time I had signed back in, my post was lost.
I really want this writing back. All I want is the memory from Safari, so I can search through it's contents for a few keywords to see if I can get my writing back.
Any ideas anyone?
At the very least, even if I Don't get my writing back, I'll learn something about gdb. Which could come in handy in my software development ;)
Thanks if you can help! It would mean so much to me. I'm going to leave Safari and gdb running, until I get an answer. Im not gonna let this go until I find out that I can or can't get my writing back.
If anyone wants to give more general answers about how to recover lost work... thats a good thing. Such as programs to search my entire hard disk for specific strings that might have been in VRAM before the work was lost.
http://email@example.com/msg22978.html This page says that kill -9 doesn't generate a core dump. Despite what this page says http://developer.apple.com/mac/library/technotes/tn2004/tn2124.html#SECCOREDUMPS , this command "kill -ABRT (PID HERE)", will not create a core dump.
ls -la /cores total 0 drwxrwxr-t@ 2 root admin 68 23 Jun 07:19 . drwxrwxr-t 38 root admin 1360 14 Dec 16:06 ..
Hey everyone, I found how to generate a coredump on OSX!
There is a downloadable program there, in source form. I downloaded it, compiled it, and, hooray! It worked! It generated an almost 1GB core dump!
Whether or not the information is in there doesn't quite matter now. I learnt how to generate coredumps on OSX, which is definitely could be a handy skill as a software developer ;) You never know when a core dump could come in handy.
I can just imagine a few years time I'm doing an important job, and I need a core dump to figure out whats going on, and this "gcore" app is what I needed. Even if it pays off once... this is a good thing.
Safari saves form data for all forms (unless you turned it off, or the site marks the form as not-to-be-saved), in an encrypted database file.
You can find the password for the file in your login keychain, and the file is at
~/Library/Safari/Form Values, so theoretically, you could extract the data from the file, and see if what you typed is in there.
However, I've had a hack, and I can't work out what format the file is, or how it's encrypted, so I don't know how to actually get at the contents, I'm sure someone does though :)
See if OSX has a pmap command, it will show you the mapped memory of any running process. This is usually read from /proc in linux systems. Next, if you're searching for a particular information, you can use the gdb find command. Type help find in gdb for more instructions.
I know, old thread...
gdb has a built in command to dump a core image of the current process/program.
generate-core-file [filename] gcore [filename]
both commands do the same, the filename is optional, defaults to 'core.<process_ip>'
Huh! looks like there's even a utility installed (with gdb) named 'gcore' to dump a currently running program too. Of course, easier to pause the process with gdb, then dump it.
Finding new things every day! ... but gdb has the function built-in... just so's ya know..
User contributions licensed under CC BY-SA 3.0