core - format of core image file
The HP-UX system writes out a file containing a core image of a
terminated process when certain signals are received (see signal(5)
for the list of reasons). The most common causes are memory
violations, illegal instructions, floating point exceptions, bus
errors, and user-generated quit signals. The core image file is
called core and is written in the process's working directory
(provided it is allowed by normal access controls). A process with an
effective user ID different from its real user ID does not produce a
The file contains sufficient information to determine what the process
was doing at the time of its termination. Core file contents consist
of objects that represent different segments of a process. Each
object is preceded by a corehead data structure, and each corehead
data structure describes the corresponding object following it. The
structure is defined in <sys/core.h>, and includes the following
The space and addr members specify the virtual memory address in the
process where the described object began. The len member is the
length of the object in bytes.
The following possible values for type are defined in <sys/core.h>:
CORE_DATA Process data as it existed at the time the core
image was created. This includes initialized
data, uninitalized data, and the heap at the
time the core image is generated.
CORE_EXEC A compiler-dependent data structure containing
the exec data structure, the magic number of
the executable file, and the command (see the
declaration of the proc_exec structure in
CORE_FORMAT The version number of the core format produced.
This number changes with each HP-UX release
where the core format itself has changed.
However, it does not necessarily change with
every HP-UX release. CORE_FORMAT can thus be
easily used by core-reading tools to determine
whether they are compatible with a given core
Hewlett-Packard Company - 1 - HP-UX Release 11i: November 2000
image. This type is expressed by a four-byte
CORE_KERNEL The null-terminated version string associated
with the kernel at the time the core image was
CORE_PROC An architecture-dependent data structure
containing per-process information such as
hardware register contents. See the
declaration of the proc_info structure in
CORE_STACK Process stack contents at the time the core
image was created.
Objects dumped in a core image file are not arranged in any particular
order. Use corehead information to determine the type of the object
that immediately follows it.
adb(1), cdb(1), xdb(1), setuid(2), crt0(3), end(3C), signal(5).
Hewlett-Packard Company - 2 - HP-UX Release 11i: November 2000