CORE(5)

NAME
core - format of memory image file

SYNOPSIS
#include <sys/param.h>

DESCRIPTION
The UNIX System writes out a memory image of a terminated process when any of various errors occur. See sigvec(2) for the list of reasons; the most common are memory violations, illegal instructions, bus errors, and user-generated quit signals. The memory image is called `core' and is written in the process's working directory (provided it can be; normal access controls apply).

The core file consists of the u. area, whose size (in 64 byte `clicks') is defined by the USIZE manifest in the <sys/param.h> file. The u. area starts with a user structure as given in <sys/user.h>. The rest of the u. area consists of the kernel stack for the terminated process which includes (among other things) the processor registers at the time of the fault; see the system listings for the format of this area. The remainder of the core file consists first of the data pages and then the stack pages of the process image. The amount of data space image in the core file is given (in clicks) by the variable u_dsize in the u. area. If the text segment was not write-only and and shared it is included as the first etext bytes of the data image where etext is taken from the symbol table of the object file which generated the memory image. The amount of stack image in the core file is given (in clicks) by the variable u_ssize in the u. area.

In general the debugger adb(1) is sufficient to deal with core images.

SEE ALSO
adb(1), sigvec(2), stack(5)