Generating core dumps in el capitan

Following this article:

https://developer.apple.com/library/mac/technotes/tn2124/_index.html#//apple_ref/doc/uid/DTS10003391-CH1-SECCOREDUMPS


I'm not able to generate core dumps for the app I'm working on. killall command does not generate it, neither un-intended crashes.

Accepted Reply

You have to do the API equivalent of

ulimit -c unlimited
, which involves calling
setrlimit
to set
RLIMIT_CORE
.

IMPORTANT I recommend that you use some sort of preference to control this. If you always enable core dumps for your process then you could fill up the user’s hard disk with cores that they might have a hard time cleaning up.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Replies

Core dumps definitely work in 10.11 but there’s a couple of gotchas with the examples in TN2124:

  • the listings have been munged by our web publishing system )-:

  • the example app, TextEdit, no longer works because of System Integrity Protection

However, the basic approach still works just fine; you just have to target a non-Apple application. For example, here’s me picking on TextWrangler:

$ sw_vers
ProductName:    Mac OS X
ProductVersion: 10.11.3
BuildVersion:  15D21
$ ls -lh /cores
$ # nothing there
$ ulimit -c unlimited
$ /MyApplications/TextWrangler.app/Contents/MacOS/TextWrangler
… waiting for the kill …
Abort trap: 6 (core dumped)
$ ls -lh /cores
total 1196480
-r--------  1 quinn  admin  584M 18 Mar 10:11 core.25815

where you send the kill command as follows:

$ killall -ABRT TextWrangler

Please do file a bug against the doc. TN2124 desperately needs an update. Once we perfect the DTS Engineer Cloning Programme™, I’ll get right on that!

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

I'm working on a non-apple business app which will not be running from a terminal. Trying your example works, but if I don't execute it from the terminal then it does not produce core dumps. How do I enable it such that I get it when random crash happens.

You have to do the API equivalent of

ulimit -c unlimited
, which involves calling
setrlimit
to set
RLIMIT_CORE
.

IMPORTANT I recommend that you use some sort of preference to control this. If you always enable core dumps for your process then you could fill up the user’s hard disk with cores that they might have a hard time cleaning up.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thank you! this works for me. Its' very helpful.

Is there any hint (or supported API) for doing the inverse?


That is, to hinder someone disassembling, say, my receipt validation code, or looking at sensitive data in my process, I want to disable core dumps for my process.


Would installing an empty signal handler for SIGABRT do that?

Is there any hint (or supported API) for doing the inverse?

What you’re asking for amounts to DRM, which isn’t something that DTS supports officially, thus my answers will be limited.

The obvious answer here is to do the reverse of what I suggested to ambreen2006: in

main
, call
setrlimit
to set
RLIMIT_CORE
to 0.

You might also want to look into the

ptrace
PT_DENY_ATTACH
selector.

Would installing an empty signal handler for SIGABRT do that?

No.

SIGABRT
is mentioned here purely as an example; it’s an easy way to get the process to dump core, but it’s certainly not the only way.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thanks, Quinn! Adding your answer to things I might try in the future.


What you’re asking for amounts to DRM, which isn’t something that DTS supports officially, thus my answers will be limited.

IMHO, this is more akin to code obfuscation, recommended by Apple for receipt checking; but, no problem.

IMHO, this is more akin to code obfuscation, recommended by Apple for receipt checking; but, no problem.

Hey, DTS doesn’t support code obfuscation either (-:

To clarify, there are plenty of places that Apple uses DRM, and some of those extend to our third party partners (the App Store being one obvious example, but there are others, like FairPlay Streaming). DTS does support those technologies as a whole. What DTS doesn’t support is the development of custom DRM schemes.

Of course, the fact that DTS doesn’t support something doesn’t stop you from doing it. We’re not App Review (-:

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"