Bug 485835

Summary: "file" command doesn't clearly identify "*.dmp" (MDUMP) files
Product: [Fedora] Fedora Reporter: Steve Tyler <stephent98>
Component: fileAssignee: Daniel Novotny <dnovotny>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 10CC: dnovotny
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-04-17 09:37:30 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
example *.dmp file
none
output from minidump_dump command
none
the patch none

Description Steve Tyler 2009-02-16 22:03:35 UTC 
Description of problem:
"*.dmp" files have been left in /tmp during bug-buddy notifications.
The "file" command does not clearly identify them.

Version-Release number of selected component (if applicable):
file-4.26-4.fc10.i386

How reproducible:
Readily.

Steps to Reproduce:
1. Create a "*.dmp" file.
   Not sure how to consistently do this -- bug-buddy seems to create them.
2. cd /tmp
3. file *.dmp
  
Actual results:
380db8f8-523e-e24d-606f8c92-3515518e.dmp: data

Expected results:
"file" gives more info about the file.

Here is an informative report:
$ file core.3491 
core.3491: ELF 32-bit LSB core file Intel 80386, version 1 (SYSV), SVR4-style, from 'gdb /usr/bin/nautilus-cd-burner'

Additional info:
Bug-buddy seems to remove these files from /tmp after the bug report has been saved.

$ hexdump -C 380db8f8-523e-e24d-606f8c92-3515518e.dmp | head -4
00000000  4d 44 4d 50 93 a7 00 00  06 00 00 00 20 00 00 00  |MDMP........ ...|
00000010  00 00 00 00 62 d6 99 49  00 00 00 00 00 00 00 00  |....b..I........|
00000020  04 00 00 00 38 68 00 00  d0 00 00 00 07 00 00 00  |....8h..........|
00000030  38 00 00 00 c8 e1 00 00  0f 00 00 00 2c 00 00 00  |8...........,...|

$ strings 380db8f8-523e-e24d-606f8c92-3515518e.dmp | head -4
MDMP
RSDS
k~-S
libglade-2.0.so.0.0.7
Comment 1 Daniel Novotny 2009-03-06 12:45:48 UTC 
hello Steve, thanks for the bugreport. Can you attach sample files, please?
Comment 2 Steve Tyler 2009-03-06 21:14:10 UTC 
Created attachment 334350 [details]
example *.dmp file

Per request. Glad I saved it. :-)

[stephent@cedar tmp]$ pwd
/tmp

[stephent@cedar tmp]$ ls -l 380db8f8-523e-e24d-606f8c92-3515518e.dmp 
-rw------- 1 stephent stephent 58096 2009-02-16 13:10 380db8f8-523e-e24d-606f8c92-3515518e.dmp

[stephent@cedar tmp]$ md5sum 380db8f8-523e-e24d-606f8c92-3515518e.dmp 
3c66e759379a3339f60e0f95c6ab48eb  380db8f8-523e-e24d-606f8c92-3515518e.dmp
Comment 3 Steve Tyler 2009-03-07 11:17:33 UTC 
Created attachment 334389 [details]
output from minidump_dump command

The minidump_dump command, which is part of the bug-buddy package, seems to be able to read *.dmp files.

Attachment was generated with:
$ minidump_dump 380db8f8-523e-e24d-606f8c92-3515518e.dmp 2>/dev/null > minidump_dump_output.txt

bug-buddy-2.24.2-1.fc10.i386
Comment 4 Steve Tyler 2009-03-07 11:42:31 UTC 
Found this string in minidump_dump: google_breakpad
http://code.google.com/p/google-breakpad/
Comment 5 Steve Tyler 2009-03-07 11:58:20 UTC 
(In reply to comment #4)
> Found this string in minidump_dump: google_breakpad
> http://code.google.com/p/google-breakpad/  

Found this in minidump_format.h:

#define MD_HEADER_SIGNATURE 0x504d444d /* 'PMDM' */
     /* MINIDUMP_SIGNATURE */

http://code.google.com/p/google-breakpad/source/browse/trunk/src/google_breakpad/common/minidump_format.h

Now I understand why searching for "MDMP" didn't work.
Finally searched for the hex bytes:

$ echo 'MDMP' | hexdump -C
00000000  4d 44 4d 50 0a                                    |MDMP.|
Comment 6 Daniel Novotny 2009-04-17 09:12:53 UTC 
Created attachment 339976 [details]
the patch

I will name the magic entry "MDUMP crash report data"
Comment 7 Daniel Novotny 2009-04-17 09:37:30 UTC 
fixed in rawhide (file-5.00-6.fc12)
Comment 8 Steve Tyler 2009-04-17 19:52:02 UTC 
(In reply to comment #6)
> Created an attachment (id=339976) [details]
> the patch
> 
> I will name the magic entry "MDUMP crash report data"  

It was my mistake calling it "MDUMP" in the bug description --
what I meant was "MDMP".

ISTM, "minidump crash report" would be more accurate though:
http://code.google.com/p/google-breakpad/source/browse/trunk/src/google_breakpad/common/minidump_format.h

Thanks in any case.