elf core dump - reading NT_PRPSINFO

[Fredrick]

Sorry for not clearly specifying.

Yes "core" is a core dump file.

I see that fs/binfmt_elf.c does put information about the process
that cored in a ".note" elf section as NT_PRPSINFO.

Is there a standard tool to dump this information?
Tried googling, could nt find anything :(.

-Fredrick

On 01/21/2012 09:45 AM, Mulyadi Santosa wrote:
> Hi :)
>
> On Fri, Jan 20, 2012 at 13:57, Fredrick<fjohnber at zoho.com>  wrote:
>> Hi,
>>
>> $ readelf -n core
>
> is that "core" a core dump?
>
>> Does anyone know how to read this NT_PRPSINFO ?
>> Is hexdump the only way to decode this?
>> Are there any tools to dump this data ?
>
> if it is indeed core dump, I think simply pass it to gdb, e.g:
> gdb<program elf binary>  <the above core name>
> and start playing with it e.g dumping stack trace.
>
> NB: IMHO NT_PRPSINFO is just a section that describes the VMAs of the
> crashed program. Quite likely an ELF documentation will mention about
> it. Try googling...