CORE(5)                       File Formats Manual                      CORE(5)


     core - memory image file format


     #include <sys/types.h>
     #include <sys/exec_elf.h>


     A small number of signals which cause abnormal termination of a process
     also cause a record of the process's in-core state to be written to disk
     for later examination by one of the available debuggers (see

     By default, this memory image is written to a file named programname.core
     in the working directory, provided the terminated process had write
     permission in the directory, and the terminated process either had an
     effective user ID of zero or had never changed user or group ID.  See the
     description of KERN_NOSUIDCOREDUMP in sysctl(2) for other options.

     The maximum size of a programname.core file is limited by setrlimit(2).
     Files which would be larger than the limit are not created.

     The programname.core file is in the ELF binary file format with an e_type
     of ET_CORE.  It has no section header table and a segment header that
     contains PT_LOAD and PT_NOTE segments that describe the state of the
     process when terminated.

     The PT_LOAD segments hold images of the process memory when it was
     terminated.  Device mappings are excluded, as are read-only mappings that
     do not have private mapping changes.  Each segment's p_vaddr, p_memsz,
     and p_flags specify the address, size, and access protection of the
     memory segment it describes.

     The PT_NOTE segment contains notes describing the kernel state and CPU
     registers of each thread in the process.  Notes describing the process as
     a whole have the name "OpenBSD".  An NT_OPENBSD_PROCINFO note is included
     containing an elfcore_procinfo structure with information about the
     kernel state of the process.  An NT_OPENBSD_AUXV note is included
     containing a copy of the original process environment strings.  On
     sparc64, an NT_OPENBSD_WCOOKIE note is included containing the process's
     `window cookie'.

     Notes describing the individual threads in the process have names in the
     format "OpenBSD@%d" where the suffix is the thread ID.  For each thread,
     an NT_OPENBSD_REGS note is included containing the state of the regular
     registers of the thread and, on architectures other than luna88k and sgi,
     an NT_OPENBSD_FPREGS note is also included containing the state of the
     floating-point registers of the thread.


     gdb(1), setrlimit(2), sigaction(2), sysctl(2)


     A core file format appeared in Version 3 AT&T UNIX.  OpenBSD 2.0 started
     using the ELF format for some architectures.  All architectures used ELF
     starting in OpenBSD 5.4.


     Programs which are started with either the set-user-ID or set-group-ID
     bits set, or which change their UID or GID after starting, will normally
     not dump core.  This is to prevent sensitive information from
     inadvertently ending up on disk.  This behaviour can be changed (for
     debugging purposes) by changing the kern.nosuidcoredump sysctl(2)
     variable to the right settings.

OpenBSD 6.4                    January 12, 2018                    OpenBSD 6.4

[Unix Hosting | Open-Source | Contact Us]
[Engineering & Automation | Software Development | Server Applications]