|CORE(5)||File Formats Manual||CORE(5)|
By default, this memory image is written to a file named
programname.core in the working directory, provided
the terminated process had write permission in the directory, and the
terminated process either had an effective user ID of zero or had never
changed user or group ID. See the description of
sysctl(2) for other options.
The maximum size of a programname.core file is limited by setrlimit(2). Files which would be larger than the limit are not created.
The programname.core file is in the ELF
binary file format with an e_type of
ET_CORE. It has no section header table and a
segment header that contains
PT_NOTE segments that describe the state of the
process when terminated.
PT_LOAD segments hold images of the
process memory when it was terminated. Device mappings are excluded, as are
read-only mappings that do not have private mapping changes. Each segment's
p_vaddr, p_memsz, and
p_flags specify the address, size, and access
protection of the memory segment it describes.
PT_NOTE segment contains notes
describing the kernel state and CPU registers of each thread in the process.
Notes describing the process as a whole have the name
is included containing an elfcore_procinfo structure
with information about the kernel state of the process. An
NT_OPENBSD_AUXV note is included containing a copy
of the original process environment strings. On sparc64, an
NT_OPENBSD_WCOOKIE note is included containing the
process's ‘window cookie’.
Notes describing the individual threads in the process have names
in the format “OpenBSD@%d” where the suffix is the thread ID.
For each thread, an
NT_OPENBSD_REGS note is included
containing the state of the regular registers of the thread and, on
architectures other than luna88k and sgi, an
NT_OPENBSD_FPREGS note is also included containing
the state of the floating-point registers of the thread.
corefile format appeared in Version 3 AT&T UNIX. OpenBSD 2.0 started using the ELF format for some architectures. All architectures used ELF starting in OpenBSD 5.4.
kern.nosuidcoredumpsysctl(2) variable to the right settings.
|January 12, 2018||OpenBSD-current|