Re: Custom core file

[Nikolay Martyanov <nmartyanov@ptsecurity.com>]

<http://www.securitylab.ru/>Thanks for response!

 > Then in the same python script execute dump/restore commands to load 
these into memory

I have tried to use "dump/restore" approach, but there is an issue.
When you use a restore command, you should already be in a context of 
debugging process.

I tried it like this:
1. Run GDB
2. Load symbols with  `file core.so`
3. Try to shove memory with `restore raw_mem.dump`
After that I have message: `You can't do that without a process to debug.`

So, I guess, dump/restore approach works only in two cases:
a) debugging live process you have attached to (it's not my case, as I 
perform postmortem debug)
b) already has loaded core file, which provides a context via saved CPU 
state - and it is the way I chose to follow.

Am I wrong in my guesses?

Thanks,
Nikolay