Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
CORE(5)			  FreeBSD File Formats Manual		       CORE(5)

     core -- memory image file format

     #include <sys/types.h>
     #include <sys/exec_elf.h>

     A small number of signals which cause abnormal termination	of a process
     also cause	a record of the	process's in-core state	to be written to disk
     for later examination by one of the available debuggers (see

     By	default, this memory image is written to a file	named programname.core
     in	the working directory, provided	the terminated process had write per-
     mission in	the directory, and the terminated process either had an	effec-
     tive user ID of zero or had never changed user or group ID.  See the de-
     scription of KERN_NOSUIDCOREDUMP in sysctl(2) for other options.

     The maximum size of a programname.core file is limited by setrlimit(2).
     Files which would be larger than the limit	are not	created.

     The programname.core file is in the ELF binary file format	with an	e_type
     of	ET_CORE.  It has no section header table and a segment header that
     contains PT_LOAD and PT_NOTE segments that	describe the state of the
     process when terminated.

     The PT_LOAD segments hold images of the process memory when it was	termi-
     nated.  Device mappings are excluded, as are read-only mappings that do
     not have private mapping changes.	Each segment's p_vaddr,	p_memsz, and
     p_flags specify the address, size,	and access protection of the memory
     segment it	describes.

     The PT_NOTE segment contains notes	describing the kernel state and	CPU
     registers of each thread in the process.  Notes describing	the process as
     a whole have the name "OpenBSD".  An NT_OPENBSD_PROCINFO note is included
     containing	an elfcore_procinfo structure with information about the ker-
     nel state of the process.	An NT_OPENBSD_AUXV note	is included containing
     a copy of the original process environment	strings.  On sparc64, an
     NT_OPENBSD_WCOOKIE	note is	included containing the	process's `window

     Notes describing the individual threads in	the process have names in the
     format "OpenBSD@%d" where the suffix is the thread	ID.  For each thread,
     an	NT_OPENBSD_REGS	note is	included containing the	state of the regular
     registers of the thread and, on architectures other than luna88k and sgi,
     an	NT_OPENBSD_FPREGS note is also included	containing the state of	the
     floating-point registers of the thread.

     gdb(1), setrlimit(2), sigaction(2), sysctl(2)

     A core file format	appeared in Version 1 AT&T UNIX.  OpenBSD 2.0 started
     using the ELF format for some architectures.  All architectures used ELF
     starting in OpenBSD 5.4.

     Programs which are	started	with either the	set-user-ID or set-group-ID
     bits set, or which	change their UID or GID	after starting,	will normally
     not dump core.  This is to	prevent	sensitive information from inadver-
     tently ending up on disk.	This behaviour can be changed (for debugging
     purposes) by changing the kern.nosuidcoredump sysctl(2) variable to the
     right settings.

FreeBSD	13.0		       September 6, 2019		  FreeBSD 13.0


Want to link to this manual page? Use this URL:

home | help