core(4)                   FILE FORMATS                    core(4)



NAME
     core - core image file

DESCRIPTION
     The UNIX System writes out a core image of a process when it
     is  terminated due to the receipt of some signals.  The core
     image is called core and is written in the process's working
     directory  (provided  it  can  be;  normal  access  controls
     apply).  A process with an effective user ID different  from
     the real user ID will not produce a core image.

     The core file contains all the process information pertinent
     to debugging: contents of hardware registers, process status
     and process data.  The format of a core file is object  file
     specific.

     For ELF executable programs [see a.out(4)],  the  core  file
     generated  is  also  an ELF file, containing ELF program and
     file headers.  The etype field in the file header has  type
     ETCORE.   The  program  header  contains an entry for every
     loadable and writeable segment that was part of the  process
     address  space, including shared library segments.  The con-
     tents of the segments themselves are also part of  the  core
     image.

     The program header of an ELF core file also contains a  NOTE
     segment.   This  segment  may contain the following entries.
     Each has entry name "CORE" and presents the  contents  of  a
     system structure:

     prstatust
          The entry containing this structure has a NOTE type  of
          1.   This  structure  contains  things of interest to a
          debugger from the operating system's  u-area,  such  as
          the general registers, signal dispositions, state, rea-
          son for stopping, process ID and so forth.  The  struc-
          ture is defined in <sys/procfs.h>.

     fpregsett
          This entry is present only  if  the  process  used  the
          floating-point  hardware.   It has a NOTE type of 2 and
          contains the floating-point registers.  The  fpregsett
          structure is defined in <sys/regset.h>.

     prpsinfot
          The entry containing this structure has a NOTE type  of
          3.   It  contains  information of interest to the ps(1)
          command, such as  process  status,  cpu  usage,  "nice"
          value,  controlling  terminal, user ID, process ID, the
          name of the executable and so forth.  The structure  is
          defined in <sys/procfs.h>.




                                                                1

core(4)                   FILE FORMATS                    core(4)



     COFF executable programs produce core  files  consisting  of
     two  parts: the first section is a copy of the system's per-
     user data for the process, including the general  registers.
     The  format  of  this section is defined in the header files
     <sys/user.h> and <sys/reg.h>.  The remainder of a COFF  core
     image  represents  the  actual  contents of the process data
     space.

     The size of the core file created by a process may  be  con-
     trolled by the user [see getrlimit(2)].

SEE ALSO
     sdb(1), getrlimit(2),  setuid(2),  elf(3E),  a.out(4),  sig-
     nal(5).
     crash(1M) in the System Administrator's Reference Manual.
     The "Object Files" chapter in the Programmer's Guide: ANSI C
     and Programming Support Tools.






































                                                                2