Sorry for not clearly specifying.

Yes "core" is a core dump file.

I see that fs/binfmt_elf.c does put information about the process
that cored in a ".note" elf section as NT_PRPSINFO.

Is there a standard tool to dump this information?
Tried googling, could nt find anything :(.

-Fredrick

On 01/21/2012 09:45 AM, Mulyadi Santosa wrote:

Hi :)

On Fri, Jan 20, 2012 at 13:57, Fredrick[off-list ref]  wrote:

quoted

Hi,

$ readelf -n core

is that "core" a core dump?

quoted

Does anyone know how to read this NT_PRPSINFO ?
Is hexdump the only way to decode this?
Are there any tools to dump this data ?

if it is indeed core dump, I think simply pass it to gdb, e.g:
gdb<program elf binary>  <the above core name>
and start playing with it e.g dumping stack trace.

NB: IMHO NT_PRPSINFO is just a section that describes the VMAs of the
crashed program. Quite likely an ELF documentation will mention about
it. Try googling...