Re: magic file entry to understand core dumps

Andrew C. Esh (
Mon, 22 Jul 1996 13:41:25 -0500

>>>>> "Aaron" == Aaron Ucko <> writes:

JM> core: ELF 32-bit LSB core file i386 (386 and up) Version 1
>>> He wanted an addition to the magic file to show the program
>>> which dumped core, as the a.out entry does. However, a quick
>>> check shows that it isn't a simple offset... anyone have
>>> better knowledge of the format?
>> Like I said, a cheesy program would be worthwhile...gdb does
>> it, but you first have to know the program which cored for gdb
>> to spit out the command line..

Aaron> I normally just use "strings core" and look for the
Aaron> probable executable name...not ideal, but it works.

This is not meant for Aaron in particular.

I think we are diverging. And besides, I don't like the "strings"
solution. "gdb" and "file" should do their job.

The original problem was defined much earlier, and I haven't seen a
good response yet. In the ensuing discussion, there has been another
problem uncovered. Here are the two solutions I would like to see. I
have seen no other new problems uncovered in this discussion:

Problem 1: "gdb" has trouble reading things from ELF core files, and
reports errors.

Check this out: (The C code was given in one of the original reports.)

[andrewes@andrewes andrewes]$ cat test.c
printf("%d\n", 0/0);
[andrewes@andrewes andrewes]$ gcc -g -o test test.c
[andrewes@andrewes andrewes]$ ./test
Floating point exception (core dumped)
[andrewes@andrewes andrewes]$ gdb -c core ./test
GDB is free software and you are welcome to distribute copies of it
under certain conditions; type "show copying" to see the conditions.
There is absolutely no warranty for GDB; type "show warranty" for details.
GDB 4.15.1 (i486-unknown-linux),
Copyright 1995 Free Software Foundation, Inc...
Couldn't fetch registers from core file: File in wrong format
Couldn't fetch registers from core file: File in wrong format
#0 0x0 in ?? ()
(gdb) list
1 main()
2 {
3 printf("%d\n", 0/0);
4 }
(gdb) quit

Note that I gave it the executable name. So, the specific original
problem was the above, "File in wrong format", error. I've had it for
months. I had hoped that upgrades to libraries, or gdb would solve it,
but it hasn't. Note my gdb version number is 4.15.1.

Solution 1: Fix "gdb".

Problem 2: "file" does not list the executable name for ELF core file
like it did for a.out files. I ran "file on the corefile from the
above example.

[andrewes@andrewes andrewes]$ file core
core: ELF 32-bit LSB core file i386 (386 and up) Version 1

It knows it's a core file, but doesn't give the "executable name" that
you need in order to start gdb.

Solution 2: Add an entry to /etc/magic to allow "file" to decode an
ELF core file. This may not be possible, if "file" is too simple to
deal with the complexities of finding the executable name. BTW: My
"file" is about a year old. I can't tell what version it is. It's ELF.

NOTE: I don't think anyone who reported the two original problems
asked to have either tool show the whole "command line" (argv dump) of
whatever caused the coredump. While this would be nice, and is
desirable if it's easy, it is new (AFAIK). Let's just fix the broken
things, for now. We need the executable name (from "file", "strings")
for gdb to run. We need gdb to run right, even when given the
executable name.

Also: Feel free to split this into to two threads if you want. And
please don't quote the whole thing over just to say "Upgrade to gdb
4.xx.y, ya doof!", or such.

Andrew C. Esh
Computer Network Technology (finger for PGP key)
6500 Wedgwood Road		612.550.8000 (main)
Maple Grove MN 55311		612.550.8229 (direct) - CNT Inc. Home Page - ACE Home Page