From mboxrd@z Thu Jan  1 00:00:00 1970
From: fjohnber@zoho.com (Fredrick)
Date: Mon, 23 Jan 2012 10:06:34 -0800
Subject: elf core dump - reading NT_PRPSINFO
In-Reply-To: <CAGdaadYy8-PmjXWdDipWNdNu69Mhffjowa_ApQ_Mwmpiv1_dCg@mail.gmail.com>
References: <4F191063.9030907@zoho.com>
	<CAGdaadYy8-PmjXWdDipWNdNu69Mhffjowa_ApQ_Mwmpiv1_dCg@mail.gmail.com>
Message-ID: <4F1DA1AA.3080706@zoho.com>
To: kernelnewbies@lists.kernelnewbies.org
List-Id: kernelnewbies.lists.kernelnewbies.org

Sorry for not clearly specifying.

Yes "core" is a core dump file.

I see that fs/binfmt_elf.c does put information about the process
that cored in a ".note" elf section as NT_PRPSINFO.

Is there a standard tool to dump this information?
Tried googling, could nt find anything :(.

-Fredrick

On 01/21/2012 09:45 AM, Mulyadi Santosa wrote:
> Hi :)
>
> On Fri, Jan 20, 2012 at 13:57, Fredrick<fjohnber@zoho.com>  wrote:
>> Hi,
>>
>> $ readelf -n core
>
> is that "core" a core dump?
>
>> Does anyone know how to read this NT_PRPSINFO ?
>> Is hexdump the only way to decode this?
>> Are there any tools to dump this data ?
>
> if it is indeed core dump, I think simply pass it to gdb, e.g:
> gdb<program elf binary>  <the above core name>
> and start playing with it e.g dumping stack trace.
>
> NB: IMHO NT_PRPSINFO is just a section that describes the VMAs of the
> crashed program. Quite likely an ELF documentation will mention about
> it. Try googling...