hx(1)
A post-mortem debugger for analyzing core dumps and examining process memory on Linux.
Synopsis
hx [OPTION]... [FILE]Description
hx is a debugger designed for inspecting core dumps, crashed processes, and live process memory. It provides a command-line interface for examining memory contents, registers, stack traces, and loaded libraries without requiring the original executable or debug symbols in many cases.
Unlike gdb, hx focuses on memory analysis and forensic investigation of core dumps. It's particularly useful for understanding what a process was doing at the moment of crash, examining heap corruption, and analyzing memory layouts in production environments.
Common options
| Flag | What it does |
|---|---|
-c, --core FILE | Specify the core dump file to analyze |
-p, --pid PID | Attach to a running process by its process ID |
-e, --exe FILE | Specify the executable file corresponding to the core dump |
-m, --maps FILE | Use a custom /proc/[pid]/maps file for memory layout information |
-s, --symbols DIR | Search directory for symbol files and debug information |
-q, --quiet | Suppress non-essential output and warnings |
-v, --verbose | Increase verbosity of output |
--help | Display help message and exit |
Examples
Analyze a core dump from a crashed application with its executable
hx -c core.dump -e /usr/bin/myappAttach to the current shell process and execute debugger commands from a file
hx -p $$ < commands.txtDisplay the first 50 lines of information from a core dump analysis
hx -c core.dump | head -50Analyze a core dump using debug symbols from a specific directory
hx -c core.dump -s /usr/lib/debugAttach to process 1234 with verbose output showing detailed memory information
hx -p 1234 -vAnalyze a core dump using custom memory maps file instead of /proc
hx -c core.dump -e ./a.out -m /tmp/custom_maps