#!/bin/bash

usage() {
    cat<<EOF>&2
USAGE: elfnote <corefile> <note pattern>

example: elfnote ./vmcore PRSTATUS will show PRSTATUS (registers)
EOF
    exit 1
}

[[ -n "$1" ]] || usage
file="$1"
shift
[[ -n "$1" ]] || usage
pattern="$1"
shift

notes=( $(readelf -n $file | awk --non-decimal-data \
    "/Notes at offset/ { offset = \$4 } \
     /$pattern/ { print offset + 20 \":\" 0 + \$2 } \
     /CORE|QEMU/ { offset += 20 + \$2 }"))

for note in "${notes[@]}"
do
    offset=${note%:*}
    size=${note#*:}

    printf "offset: 0x%x size: 0x%x\n" $offset $size
    echo "------------------------------------------------------"
    od -A x -t x1 -j $offset -N $size $file
    echo
done