gdb - Core dump note section -

following question manually generating core dump file, decided dive , hands dirty.

i able build basic core dump structure , dead program's memory core dump within big load section. when debugging in gdb, variables back, no problem that. here comes tricky part, how gdb retrieve information program when crashed.

i know note section of core dump contains information (cpu registers among others). here objdump -h gives "real" core dump :

core.28339:     file format elf32-i386  sections: idx name          size      vma       lma       file off  algn   0 note0         000001e8  00000000  00000000  000000f4  2**0                   contents, readonly   1 .reg/28339    00000044  00000000  00000000  00000150  2**2                   contents   2 .reg          00000044  00000000  00000000  00000150  2**2               contents   3 .auxv         000000a0  00000000  00000000  0000023c  2**2               contents   4 load1a        00001000  08010000  00000000  00001000  2**12               contents, alloc, load, readonly, code   .. other load sections ... 

i figured out readelf .reg sections contain data mapped structures :

notes @ offset 0x000000f4 length 0x000001e8:   owner     data size   description   core      0x00000090  nt_prstatus (prstatus structure)   core      0x0000007c  nt_prpsinfo (prpsinfo structure)   core      0x000000a0  nt_auxv (auxiliary vector) 

can give me directions on how structured notes section ? tried writing directly structures file, did not work , missing here. looked @ google coredumper code , took bits of it, writing note section not simple , detailed information contains , format welcomed.

edit #1 : following 1st comment

i figured out elf file should structured follows :

• elf header elfw(ehdr)
• program headers (ehdr.e_phnum times elfw(phdr)), here used 1 pt_note , 1 pt_load headers
• note sections :
  • section's header (elfw(nhdr))
  • section's name (.n_namesz long)
  • section's data (.n_descsz long)
• program section containing program's memory

then have put 3 note records, 1 prstatus, 1 prpsinfo , 1 auxiliary vector.

this seems right way readelf gives me similar output got above real core dump.

edit #2 : after getting correct structure

i struggling different structures composing note records.

here when running eu-readelf --notes on core dump :

note segment of 540 bytes @ offset 0x74:   owner          data size  type   core                 336  prstatus   core                 136  prpsinfo   core                   8  auxv     null 

here when running same command on real core dump :

note segment of 488 bytes @ offset 0xf4:   owner          data size  type   core                 144  prstatus     info.si_signo: 11, info.si_code: 0, info.si_errno: 0, cursig: 11     sigpend: <>     sighold: <>     pid: 28339, ppid: 41446, pgrp: 28339, sid: 41446     utime: 0.000000, stime: 0.000000, cutime: 0.000000, cstime: 0.000000     orig_eax: -1, fpvalid: 0     ebx:             -1  ecx:              0  edx:              0     esi:              0  edi:              0  ebp:     0xffb9fcbc     eax:             -1  eip:     0x08014b26  eflags:  0x00010286     esp:     0xffb9fcb4     ds: 0x002b  es: 0x002b  fs: 0x0000  gs: 0x0000  cs: 0x0023  ss: 0x002b   core                 124  prpsinfo     state: 0, sname: r, zomb: 0, nice: 0, flag: 0x00400400     uid: 9432, gid: 6246, pid: 28339, ppid: 41446, pgrp: 28339, sid: 41446     fname: pikeos_app, psargs: ./pikeos_app    core                 160  auxv     sysinfo: 0xf7768420     sysinfo_ehdr: 0xf7768000     hwcap: 0xbfebfbff  <fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe>     pagesz: 4096     clktck: 100     phdr: 0x8010034     phent: 32     phnum: 2     base: 0     flags: 0     entry: 0x80100be     uid: 9432     euid: 9432     gid: 6246     egid: 6246     secure: 0     random: 0xffb9ffab     execfn: 0xffba1feb     platform: 0xffb9ffbb     null 

does have clue or explanations why note records not read ? thought might due incorrect offsets, why records correctly listed ?

thanks !

can give me directions on how structured notes section?

the notes section concatenation of variable-sized note records. each note record begins elfw(nhdr) structure, followed (variable sized) name (of length .n_namesz, padded total size of name on disk divisible 4) , data (of length .n_descsz, padded).