crashdump

A crash dump is a snapshot of a running program's memory and execution state at the moment it terminates unexpectedly. It is generated to assist developers and system administrators in diagnosing crashes and faults. A dump typically includes a memory image, the contents of the program's CPU registers, the call stack for each thread, loaded modules, and basic process state such as thread contexts. Depending on platform and configuration, the amount of data collected can range from a small minidump to a full memory dump.

Different platforms have different implementations. Linux and other Unix-like systems commonly produce a core dump when a process terminates due to a signal; Windows generates crash dumps such as minidumps and full dumps via Windows Error Reporting; macOS produces crash reports that summarize thread states and stack frames. Names and formats vary: Linux core files named "core" or as dictated by core_pattern, Windows .dmp files, macOS .crash reports.

Generation and configuration details vary. On Linux, enabling core dumps typically requires setting resource limits (ulimit -c unlimited) and configuring the kernel's core_pattern to determine where dumps are written. Windows dumps are controlled by system settings and can be configured to collect small, kernel, or complete memory dumps. macOS crash reporting is integrated with the system crash reporter and diagnostic channels.

Analysis uses specialized tools. Windows dumps can be analyzed with WinDbg or CDB; Linux dumps with GDB, crash, or perf tools; macOS with LLDB or Xcode. Crash dumps support debugging by providing stack traces, module lists, and memory layouts, helping identify faulting code paths, timing issues, or data corruption. Because dumps may contain sensitive data, access should be restricted and data sanitized before sharing.