By default, crashes are reported into .crash files which can be found in /Library/Logs/DiagnosticReports (system-wide) and ~/Library/Logs/DiagnosticReports (user). These files can be opened by using Console app, in User or System Reports. The .crash files are in plain text format and should include relevant information about the crash.
In order to activate the full core dumps, make sure that /cores directory has write permissions for the current user (test by: touch /cores/test && rm /cores/test). In addition, make sure that you don’t have any limits on core file sizes by:
ulimit -c unlimited
The name of the core dump file is in format: core.PID.
If the directory is hidden, you can show the hidden files by:
defaults write com.apple.finder AppleShowAllFiles TRUE
You can test that by the following commands:
sleep 100 &
killall -SIGSEGV sleep
which should say extra (core dumped), after Segmentation fault message.
The core dump files should be found by default in /cores directory.
Example by commands:
$ ulimit -c unlimited
$ sleep 100 &
$ killall -SIGSEGV sleep # Then press Enter few times till below message is shown
[1]+ Segmentation fault: 11 (core dumped) sleep 100
$ ls /cores
core.13652
$ lldb -c /cores/core.*
(lldb) target create --core "/cores/core.13652"
Core file '/cores/core.13652' (x86_64) was loaded.
(lldb) bt
* thread #1, stop reason = signal SIGSTOP
* frame #0: 0x00007fffa7d13fde libsystem_kernel.dylib`__semwait_signal + 10
frame #1: 0x00007fffa7c9ab92 libsystem_c.dylib`nanosleep + 199
frame #2: 0x000000010c090002 sleep`rpl_nanosleep + 128
See also: Technical Note TN2118 – Kernel Core Dumps.