NAME

core − core image file

DESCRIPTION

The UNIX system writes out a core image of a process when it is terminated due to the receipt of some signals.  The core image is called core and is written in the process’s working directory (provided it can be; normal access controls apply).  A process with an effective user ID different from the real user ID will not produce a core image. 

The core file contains all the process information pertinent to debugging: contents of hardware registers, process status and process data.  The format of a core file is object file specific. 

For ELF executable programs [see a.out(4)], the core file generated is also an ELF file, containing ELF program and file headers.  The e_type field in the file header has type ET_CORE.  The program header contains an entry for every loadable and writeable segment that was part of the process address space, including shared library segments.  The contents of the segments themselves are also part of the core image. 

The program header of an ELF core file also contains a NOTE segment.  This segment may contain the following entries.  Each has entry name "CORE" and presents the contents of a system structure:

prstatus_t The entry containing this structure has a NOTE type of 1.  This structure contains things of interest to a debugger from the operating system’s ­u-area, such as the general registers, signal dispositions, state, reason for stopping, process ID and so forth.  The structure is defined in sys/procfs.h. 

prpsinfo_t The entry containing this structure has a NOTE type of 3.  It contains information of interest to the ps(1) command, such as process status, cpu usage, "nice" value, controlling terminal, user ID, process ID, the name of the executable and so forth.  The structure is defined in sys/procfs.h. 

For 68k only COFF executable programs produce core files consisting of two parts: the first section is a copy of the system’s per-user data for the process, including the general registers.  The format of this section is defined in the header files sys/user.h and sys/reg.h.  The remainder of a COFF core image represents the actual contents of the process data space. 

For 88k only COFF executable programs produce core files in the following format (data structures are defined in sys/ptrace.h):

a struct ptrace_user containing the current status of the process

one struct pt_mem_desc for each shared memory segment attached to the process

one struct pt_mem_desc for each shared library data segment attached to the process

the process’s data segment

the process’s stack segment

the contents of the shared memory and shared library data segments referred to by the pt_mem_desc entries

The size of the core file created by a process may be controlled by the user [see getrlimit(2)]. 

SEE ALSO

crash(1M), tbx(1), getrlimit(2), setuid(2), elf(3E), a.out(4), signal(5).