Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to know how I can dump memory in, to a file.

I've entered gdb attach 6741 (my safari PID).

Now what?

I tried searching for help on gdb on google, but I couldn't find anything that told me what to do, even when searching for "how to dump memory in gdb" :(

I tried "help dump", it gave me a bunch of commands, but none of them worked. The closest I came was:

(gdb) dump memory ~/safaridump.bin 0
Missing stop address.

So whats the stop address? I don't know? How am I meant to know the stop address? I tried searching on google for ""missing stop address" gdb", it didn't help. I have no idea how I get the stop address.

I tried this:

(gdb) dump memory ~/safaridump.bin 0 0xffffffff

That didn't work either.

I got this:

gdb stack crawl at point of internal error:
0   gdb-i386-apple-darwin               0x0012fd8f internal_vproblem + 316
1   gdb-i386-apple-darwin               0x0012ffd3 internal_verror + 43
2   gdb-i386-apple-darwin               0x00130008 align_down + 0
3   gdb-i386-apple-darwin               0x00130a21 xstrvprintf + 0
4   gdb-i386-apple-darwin               0x00130c25 xmalloc + 40
5   gdb-i386-apple-darwin               0x000045d6 dump_memory_to_file + 241
6   gdb-i386-apple-darwin               0x0012dd3d execute_command + 713
7   gdb-i386-apple-darwin               0x0008815d command_handler + 213
8   gdb-i386-apple-darwin               0x000891af command_line_handler + 1120
9   gdb-i386-apple-darwin               0x001c2486 rl_callback_read_char + 137
10  gdb-i386-apple-darwin               0x000882ed rl_callback_read_char_wrapper + 18
11  gdb-i386-apple-darwin               0x000874b7 handle_file_event + 349
12  gdb-i386-apple-darwin               0x00086e7e process_event + 131
13  gdb-i386-apple-darwin               0x00087c38 gdb_do_one_event + 1178
14  gdb-i386-apple-darwin               0x00081bfd catch_errors + 78
/SourceCache/gdb/gdb-1346/src/gdb/utils.c:1208: internal-error: virtual memory     exhausted.
A problem internal to GDB has been detected,
further debugging may prove unreliable.
Quit this debugging session? (y or n) n

I really don't get this. All I want, is my memory in Safari, written to a file.

It's really important to me. I spent about 2 hours typing my poor heart out in Safari, writing some really important information down. And then the stupid website I was writing to, didn't accept my post, because I had taken so long writing it, that I had "signed out". By the time I had signed back in, my post was lost.

I really want this writing back. All I want is the memory from Safari, so I can search through it's contents for a few keywords to see if I can get my writing back.

Any ideas anyone?

At the very least, even if I Don't get my writing back, I'll learn something about gdb. Which could come in handy in my software development ;)

Thanks if you can help! It would mean so much to me. I'm going to leave Safari and gdb running, until I get an answer. Im not gonna let this go until I find out that I can or can't get my writing back.

If anyone wants to give more general answers about how to recover lost work... thats a good thing. Such as programs to search my entire hard disk for specific strings that might have been in VRAM before the work was lost.

... This page says that kill -9 doesn't generate a core dump. Despite what this page says , this command "kill -ABRT (PID HERE)", will not create a core dump.

ls -la /cores
total 0
drwxrwxr-t@  2 root  admin    68 23 Jun 07:19 .
drwxrwxr-t  38 root  admin  1360 14 Dec 16:06 ..
share|improve this question

migrated from Dec 20 '09 at 22:18

This question came from our site for professional and enthusiast programmers.

+1 sympathy upvote -- I'm not optimistic about the prospects of recovering your data, given what you've tried already. But it's a legitimate debugging question, clearly written, with pertinent details included: I don't think it deserves to be downvoted! – Jim Lewis Dec 20 '09 at 17:48
NSD. How do you find the end of the heap? What is the command you have to type to get the number returned to you? Do you actually know? Or are you just trying to not help me? – boytheo Dec 20 '09 at 18:59
This isnt working very well. I tried this: <…; So I typed "gcore bla2.bin". And guess do I get? "Undefined command: "gcore". Try "help"." Apple's docs say that this function isn't available on some systems. I guess that means Macs, too? I wonder why Apple's docs would have generic info on the unixy gdb that doesn't specify OSX's behaviour... – boytheo Dec 20 '09 at 19:18… was the link, somehow it got broken? – boytheo Dec 20 '09 at 19:20
After a bit more experimentation, I found this: "dump binary memory ~/dump3.bin 0 0x0000FFFF" produced some data that wasn't entirely zeros. But... there was nothing of value in here and it was only the first 64KB. This... "dump binary memory ~/dump3.bin 0 0x000fFFFF" produced a file entirely containing zeros. 1MB of zeros. I have no idea why. My guess (until someone who knows how to use gdb actually helps out), is that I've crossed "unused" regions, that weren't even allocated by malloc. And because of this, gdb outputs zeros. After all, Safari contains more than 1MB of data ;) – boytheo Dec 20 '09 at 19:37

Hey everyone, I found how to generate a coredump on OSX!

There is a downloadable program there, in source form. I downloaded it, compiled it, and, hooray! It worked! It generated an almost 1GB core dump!

Whether or not the information is in there doesn't quite matter now. I learnt how to generate coredumps on OSX, which is definitely could be a handy skill as a software developer ;) You never know when a core dump could come in handy.

I can just imagine a few years time I'm doing an important job, and I need a core dump to figure out whats going on, and this "gcore" app is what I needed. Even if it pays off once... this is a good thing.

share|improve this answer
You can also install it with: brew install gcore – Guido Jun 13 '14 at 14:01
You can use these instructions here to quickly install gcore. If it says that "bash: brew: command not found" then install homebrew using this link. – I'm_With_Stupid Sep 20 '15 at 6:18

Safari saves form data for all forms (unless you turned it off, or the site marks the form as not-to-be-saved), in an encrypted database file. You can find the password for the file in your login keychain, and the file is at ~/Library/Safari/Form Values, so theoretically, you could extract the data from the file, and see if what you typed is in there.

However, I've had a hack, and I can't work out what format the file is, or how it's encrypted, so I don't know how to actually get at the contents, I'm sure someone does though :)

share|improve this answer
If Safari did save the post in this file, you can also get it back simply by going to the same form and typing the first few letters of the lost text. The entire should pop up as the autocomplete suggestion. – Toon Van Acker Dec 20 '09 at 18:00
The auto-complete thing doesn't work for post content. It only works for single line fields. Not entire articles with hundreds of lines. – boytheo Dec 20 '09 at 18:56
Thanks. I doubt this file contains post content. I did manage to dump 0 to 7ffffFFFF, creating a 2GB file. However, it seemed to contain entirely zeros. Something isn't quite right here. Why would this?: dump memory ~/bla.bin 0 0x7fffFFFF Result in a file entirely containing zeros? Safari isn't running on zeros is it? I'm assuming it must have some code inside of it? ;) – boytheo Dec 20 '09 at 19:05

You could always turn logging on in GDB set logging on

Then, everything you do is printed to the log file (usually gdb.txt). So you can just start printing memory using the x command, and everything will go to the log file as well as the screen.

share|improve this answer

See if OSX has a pmap command, it will show you the mapped memory of any running process. This is usually read from /proc in linux systems. Next, if you're searching for a particular information, you can use the gdb find command. Type help find in gdb for more instructions.

share|improve this answer

I know, old thread...

gdb has a built in command to dump a core image of the current process/program.

generate-core-file [filename]
gcore [filename]

both commands do the same, the filename is optional, defaults to '*core.<process_ip>*'

Huh! looks like there's even a utility installed (with gdb) named 'gcore' to dump a currently running program too. Of course, easier to pause the process with gdb, then dump it.

Finding new things every day! ... but gdb has the function built-in... just so's ya know..

share|improve this answer
(gdb) gcore Undefined command: "gcore". Try "help". (gdb) generate-core-file Undefined command: "generate-core-file". Try "help". – Slipp D. Thompson May 6 '13 at 6:57
1 seems to suggest that it isn't implemented on OS X. – Slipp D. Thompson May 6 '13 at 6:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.