9

I need to know how I can dump memory in Safari.app, to a file.

I've entered gdb attach 6741 (my safari PID).

Now what?

I tried searching for help on gdb on google, but I couldn't find anything that told me what to do, even when searching for "how to dump memory in gdb" :(

I tried "help dump", it gave me a bunch of commands, but none of them worked. The closest I came was:

(gdb) dump memory ~/safaridump.bin 0
Missing stop address.

So whats the stop address? I don't know? How am I meant to know the stop address? I tried searching on google for ""missing stop address" gdb", it didn't help. I have no idea how I get the stop address.

I tried this:

(gdb) dump memory ~/safaridump.bin 0 0xffffffff

That didn't work either.

I got this:

gdb stack crawl at point of internal error:
0   gdb-i386-apple-darwin               0x0012fd8f internal_vproblem + 316
1   gdb-i386-apple-darwin               0x0012ffd3 internal_verror + 43
2   gdb-i386-apple-darwin               0x00130008 align_down + 0
3   gdb-i386-apple-darwin               0x00130a21 xstrvprintf + 0
4   gdb-i386-apple-darwin               0x00130c25 xmalloc + 40
5   gdb-i386-apple-darwin               0x000045d6 dump_memory_to_file + 241
6   gdb-i386-apple-darwin               0x0012dd3d execute_command + 713
7   gdb-i386-apple-darwin               0x0008815d command_handler + 213
8   gdb-i386-apple-darwin               0x000891af command_line_handler + 1120
9   gdb-i386-apple-darwin               0x001c2486 rl_callback_read_char + 137
10  gdb-i386-apple-darwin               0x000882ed rl_callback_read_char_wrapper + 18
11  gdb-i386-apple-darwin               0x000874b7 handle_file_event + 349
12  gdb-i386-apple-darwin               0x00086e7e process_event + 131
13  gdb-i386-apple-darwin               0x00087c38 gdb_do_one_event + 1178
14  gdb-i386-apple-darwin               0x00081bfd catch_errors + 78
/SourceCache/gdb/gdb-1346/src/gdb/utils.c:1208: internal-error: virtual memory     exhausted.
A problem internal to GDB has been detected,
further debugging may prove unreliable.
Quit this debugging session? (y or n) n

I really don't get this. All I want, is my memory in Safari, written to a file.

It's really important to me. I spent about 2 hours typing my poor heart out in Safari, writing some really important information down. And then the stupid website I was writing to, didn't accept my post, because I had taken so long writing it, that I had "signed out". By the time I had signed back in, my post was lost.

I really want this writing back. All I want is the memory from Safari, so I can search through it's contents for a few keywords to see if I can get my writing back.

Any ideas anyone?

At the very least, even if I Don't get my writing back, I'll learn something about gdb. Which could come in handy in my software development ;)

Thanks if you can help! It would mean so much to me. I'm going to leave Safari and gdb running, until I get an answer. Im not gonna let this go until I find out that I can or can't get my writing back.

If anyone wants to give more general answers about how to recover lost work... thats a good thing. Such as programs to search my entire hard disk for specific strings that might have been in VRAM before the work was lost.

...

http://www.mail-archive.com/[email protected]/msg22978.html This page says that kill -9 doesn't generate a core dump. Despite what this page says http://developer.apple.com/mac/library/technotes/tn2004/tn2124.html#SECCOREDUMPS , this command "kill -ABRT (PID HERE)", will not create a core dump.

ls -la /cores
total 0
drwxrwxr-t@  2 root  admin    68 23 Jun 07:19 .
drwxrwxr-t  38 root  admin  1360 14 Dec 16:06 ..
6
  • 1
    +1 sympathy upvote -- I'm not optimistic about the prospects of recovering your data, given what you've tried already. But it's a legitimate debugging question, clearly written, with pertinent details included: I don't think it deserves to be downvoted!
    – Jim Lewis
    Dec 20, 2009 at 17:48
  • NSD. How do you find the end of the heap? What is the command you have to type to get the number returned to you? Do you actually know? Or are you just trying to not help me?
    – boytheo
    Dec 20, 2009 at 18:59
  • This isnt working very well. I tried this: <developer.apple.com/mac/library/documentation/DeveloperTools/…> So I typed "gcore bla2.bin". And guess do I get? "Undefined command: "gcore". Try "help"." Apple's docs say that this function isn't available on some systems. I guess that means Macs, too? I wonder why Apple's docs would have generic info on the unixy gdb that doesn't specify OSX's behaviour...
    – boytheo
    Dec 20, 2009 at 19:18
  • developer.apple.com/mac/library/documentation/DeveloperTools/… was the link, somehow it got broken?
    – boytheo
    Dec 20, 2009 at 19:20
  • After a bit more experimentation, I found this: "dump binary memory ~/dump3.bin 0 0x0000FFFF" produced some data that wasn't entirely zeros. But... there was nothing of value in here and it was only the first 64KB. This... "dump binary memory ~/dump3.bin 0 0x000fFFFF" produced a file entirely containing zeros. 1MB of zeros. I have no idea why. My guess (until someone who knows how to use gdb actually helps out), is that I've crossed "unused" regions, that weren't even allocated by malloc. And because of this, gdb outputs zeros. After all, Safari contains more than 1MB of data ;)
    – boytheo
    Dec 20, 2009 at 19:37

5 Answers 5

6

I found how to generate a coredump on OSX!

Link

There is a downloadable program there, in source form. I downloaded it, compiled it, and, hooray! It worked! It generated an almost 1GB core dump!

Whether or not the information is in there doesn't quite matter now. I learnt how to generate coredumps on OSX, which is definitely could be a handy skill as a software developer ;) You never know when a core dump could come in handy.

I can just imagine a few years time I'm doing an important job, and I need a core dump to figure out whats going on, and this "gcore" app is what I needed. Even if it pays off once... this is a good thing.

3
  • 1
    You can also install it with: brew install gcore
    – Guido
    Jun 13, 2014 at 14:01
  • You can use these instructions here to quickly install gcore. If it says that "bash: brew: command not found" then install homebrew using this link. Sep 20, 2015 at 6:18
  • gcore is included in macOS since 10.12 Sierra. It is located at /usr/bin/gcore and also has a man page at /usr/share/man/man1/gcore.1. This is further confirmed by Homebrew which refuses to install gcore to /usr/local/bin on Sierra or higher.
    – GDP2
    Jun 6, 2018 at 4:49
1

Safari saves form data for all forms (unless you turned it off, or the site marks the form as not-to-be-saved), in an encrypted database file. You can find the password for the file in your login keychain, and the file is at ~/Library/Safari/Form Values, so theoretically, you could extract the data from the file, and see if what you typed is in there.

However, I've had a hack, and I can't work out what format the file is, or how it's encrypted, so I don't know how to actually get at the contents, I'm sure someone does though :)

3
  • If Safari did save the post in this file, you can also get it back simply by going to the same form and typing the first few letters of the lost text. The entire should pop up as the autocomplete suggestion.
    – Toon Van Acker
    Dec 20, 2009 at 18:00
  • The auto-complete thing doesn't work for post content. It only works for single line fields. Not entire articles with hundreds of lines.
    – boytheo
    Dec 20, 2009 at 18:56
  • Thanks. I doubt this file contains post content. I did manage to dump 0 to 7ffffFFFF, creating a 2GB file. However, it seemed to contain entirely zeros. Something isn't quite right here. Why would this?: dump memory ~/bla.bin 0 0x7fffFFFF Result in a file entirely containing zeros? Safari isn't running on zeros is it? I'm assuming it must have some code inside of it? ;)
    – boytheo
    Dec 20, 2009 at 19:05
0

You could always turn logging on in GDB set logging on

Then, everything you do is printed to the log file (usually gdb.txt). So you can just start printing memory using the x command, and everything will go to the log file as well as the screen.

0

See if OSX has a pmap command, it will show you the mapped memory of any running process. This is usually read from /proc in linux systems. Next, if you're searching for a particular information, you can use the gdb find command. Type help find in gdb for more instructions.

-1

I know, old thread...

gdb has a built in command to dump a core image of the current process/program.

generate-core-file [filename]
gcore [filename]

both commands do the same, the filename is optional, defaults to 'core.<process_ip>'

Huh! looks like there's even a utility installed (with gdb) named 'gcore' to dump a currently running program too. Of course, easier to pause the process with gdb, then dump it.

Finding new things every day! ... but gdb has the function built-in... just so's ya know..

2

You must log in to answer this question.