1.\" $OpenBSD: core.5,v 1.25 2021/05/01 16:11:10 visa Exp $ 2.\" $NetBSD: core.5,v 1.4 1994/11/30 19:31:11 jtc Exp $ 3.\" 4.\" Copyright (c) 1980, 1991, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" @(#)core.5 8.3 (Berkeley) 12/11/93 32.\" 33.Dd $Mdocdate: May 1 2021 $ 34.Dt CORE 5 35.Os 36.Sh NAME 37.Nm core 38.Nd memory image file format 39.Sh SYNOPSIS 40.In sys/types.h 41.In sys/exec_elf.h 42.Sh DESCRIPTION 43A small number of signals which cause abnormal termination of a process 44also cause a record of the process's in-core state to be written 45to disk for later examination by one of the available debuggers (see 46.Xr sigaction 2 ) . 47.Pp 48By default, this memory image is written to a file named 49.Pa programname.core 50in the working directory, provided the terminated process had write 51permission in the directory, 52and the terminated process either had an effective user ID of zero or 53had never changed user or group ID. 54See the description of 55.Dv KERN_NOSUIDCOREDUMP 56in 57.Xr sysctl 2 58for other options. 59.Pp 60The maximum size of a 61.Pa programname.core 62file is limited by 63.Xr setrlimit 2 . 64Files which would be larger than the limit are not created. 65.Pp 66The 67.Pa programname.core 68file is in the ELF binary file format with an 69.Va e_type 70of 71.Dv ET_CORE . 72It has no section header table and a segment header that contains 73.Dv PT_LOAD 74and 75.Dv PT_NOTE 76segments that describe the state of the process when terminated. 77.Pp 78The 79.Dv PT_LOAD 80segments hold images of the process memory when it was terminated. 81Device mappings are excluded, 82as are read-only mappings that do not have private mapping changes. 83Each segment's 84.Va p_vaddr , 85.Va p_memsz , 86and 87.Va p_flags 88specify the address, size, and access protection of the memory 89segment it describes. 90.Pp 91The 92.Dv PT_NOTE 93segment contains notes describing the kernel state and CPU registers 94of each thread in the process. 95Notes describing the process as a whole have the name 96.Dq OpenBSD . 97An 98.Dv NT_OPENBSD_PROCINFO 99note is included containing an 100.Vt elfcore_procinfo 101structure with information about the kernel state of the process. 102An 103.Dv NT_OPENBSD_AUXV 104note is included containing a copy of the original process environment strings. 105On sparc64, an 106.Dv NT_OPENBSD_WCOOKIE 107note is included containing the process's 108.Sq window cookie . 109.Pp 110Notes describing the individual threads in the process have names 111in the format 112.Dq OpenBSD@%d 113where the suffix is the thread ID. 114For each thread, an 115.Dv NT_OPENBSD_REGS 116note is included containing the state of the regular registers of 117the thread and, on architectures other than luna88k, an 118.Dv NT_OPENBSD_FPREGS 119note is also included containing the state of the floating-point 120registers of the thread. 121.Sh SEE ALSO 122.Xr gdb 1 , 123.Xr setrlimit 2 , 124.Xr sigaction 2 , 125.Xr sysctl 2 126.Sh HISTORY 127A 128.Nm 129file format appeared in 130.At v1 . 131.Ox 2.0 132started using the ELF format for some architectures. 133All architectures used ELF starting in 134.Ox 5.4 . 135.Sh CAVEATS 136Programs which are started with either the set-user-ID or 137set-group-ID bits set, 138or which change their UID or GID after starting, will normally not 139dump core. 140This is to prevent sensitive information from inadvertently ending 141up on disk. 142This behaviour can be changed (for debugging purposes) by changing the 143.Li kern.nosuidcoredump 144.Xr sysctl 2 145variable to the right settings. 146