The operating system writes out a memory image of a terminated process when any of various errors occur. See sigvec.2 for the list of reasons; the most common are memory violations, illegal instructions, bus errors, and user-generated quit signals. The memory image is called core and is written in the process's working directory (provided it can be; normal access controls apply). Set-user-ID and set-group-ID programs do not produce core files when they terminate as this would cause a security loophole.
The maximum size of a core file is limited by setrlimit (see getrlimit.2 Files which would be larger than the limit are not created.
The core file consists of a core structure, as defined in the <sys/core.h> file, followed by the data pages and then the stack pages of the process image. The core structure includes the program's header, the size of the text, data, and stack segments, the name of the program and the number of the signal that terminated the process. The program's header is described by the exec structure defined in the <sys/exec.h> file, except on Sun386i systems.
struct core { int c_magic; /* Corefile magic number */ int c_len; /* Sizeof (struct core) */ struct regs c_regs; /* General purpose registers */ struct exec c_aouthdr; /* A.out header */ int c_signo; /* Killing signal, if any */ int c_tsize; /* Text size (bytes) */ int c_dsize; /* Data size (bytes) */ int c_ssize; /* Stack size (bytes) */ char c_cmdname[CORE_NAMELEN + 1]; /* Command name */ struct fpu c_fpu; /* external FPU state */ int c_ucode; /* Exception no. from u_code */ };
The members of the structure are:
Created by unroff & hp-tools. © somebody (See intro for details). All Rights Reserved. Last modified 11/5/97