elf core dump - reading NT_PRPSINFO

DISCUSSION Fredrick 2 participants 4 messages Jan 20, 2012 – Jan 24, 2012

Share & tools

Fredrick

author

2012-01-20 06:57 UTC #0 lore raw

Hi,

$ readelf -n core

Notes at offset 0x00000274 with length 0x000004c0:
Owner Data size Description
CORE 0x00000090 NT_PRSTATUS (prstatus structure)
CORE 0x0000007c NT_PRPSINFO (prpsinfo structure)
CORE 0x000000a0 NT_AUXV (auxiliary vector)
CORE 0x0000006c NT_FPREGSET (floating point registers)
LINUX 0x00000200 NT_PRXFPREG (user_xfpregs structure)
LINUX 0x00000030 Unknown note type: (0x00000200)

Does anyone know how to read this NT_PRPSINFO ?
Is hexdump the only way to decode this?
Are there any tools to dump this data ?

Thanks,
Fredrick

Mulyadi Santosa

2012-01-21 17:45 UTC #1 lore raw

Hi :)

Quoted 3 lines · Fredrick

Hi,

$ readelf -n core

is that "core" a core dump?

Quoted 3 lines

Does anyone know how to read this NT_PRPSINFO ?
Is hexdump the only way to decode this?
Are there any tools to dump this data ?

if it is indeed core dump, I think simply pass it to gdb, e.g:
gdb <program elf binary> <the above core name>
and start playing with it e.g dumping stack trace.

NB: IMHO NT_PRPSINFO is just a section that describes the VMAs of the crashed program. Quite likely an ELF documentation will mention about it. Try googling...

Signature · 7 lines

regards,

Mulyadi Santosa
Freelance Linux trainer and consultant

blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com

Fredrick

author

2012-01-23 18:06 UTC #2 lore raw

Sorry for not clearly specifying.

Yes "core" is a core dump file.

I see that fs/binfmt_elf.c does put information about the process that cored in a ".note" elf section as NT_PRPSINFO.

Is there a standard tool to dump this information? Tried googling, could nt find anything :(.

-Fredrick

Quoted 20 lines · Mulyadi Santosa

Hi :)
Quoted 3 lines · Fredrick
Hi,
$ readelf -n core
is that "core" a core dump?
Quoted 3 lines
Does anyone know how to read this NT_PRPSINFO ?
Is hexdump the only way to decode this?
Are there any tools to dump this data ?
if it is indeed core dump, I think simply pass it to gdb, e.g:
gdb<program elf binary> <the above core name>
and start playing with it e.g dumping stack trace.
NB: IMHO NT_PRPSINFO is just a section that describes the VMAs of the crashed program. Quite likely an ELF documentation will mention about it. Try googling...

Mulyadi Santosa

2012-01-24 04:54 UTC #3 lore raw

Hi...

Quoted 9 lines · Fredrick

Sorry for not clearly specifying.
Yes "core" is a core dump file.
I see that fs/binfmt_elf.c does put information about the process that cored in a ".note" elf section as NT_PRPSINFO.
Is there a standard tool to dump this information? Tried googling, could nt find anything :(.

have you tried elfdump? sorry can't help much about it...

Signature · 7 lines

regards,

Mulyadi Santosa
Freelance Linux trainer and consultant

blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com