StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
primarykey
Id
10555046
data
AcceptedAnswerId
0
AnswerCount
0
ClosedDate
CommentCount
8
CommunityOwnedDate
CreationDate
2012-05-11T16:15:44.277
FavoriteCount
0
LastActivityDate
2014-02-26T20:04:44.883
LastEditDate
2014-02-26T20:04:44.883
LastEditorUserId
1293660
OwnerUserId
1380113
ParentId
10552756
PostTypeId
2
Score
5
ViewCount
0
LastEditorDisplayName
text
Body
<p>First you need to read the ELF specification and then read the function elf_core_dump() in the linux/fs/binfmt_elf.c to get to know how the coredump file is organised. But anyway, you can check the following program.</p> <pre><code> #include <stdio.h> #include <elf.h> #include <sys/types.h> #include <unistd.h> #include <fcntl.h> #include <stdlib.h> #include <sys/procfs.h> int main (int argc, char **arg) { Elf32_Ehdr *elfh; Elf32_Shdr *elfsh; Elf32_Phdr *elfphdr; char *p = NULL; char buf[1000], sbuf[1000]; int ret, fd, i = 0, size; if (argc < 2) { printf("\nUsage: corenotes <core>\n"); return 0; } fd = open(arg[1], O_RDONLY); if (fd < 0) { perror("open"); return 0; } /* Read ELF header*/ ret = read(fd, buf, sizeof(*elfh)); if (!ret) { perror("Error Reading the ELF Header"); goto cl; } elfh = (Elf32_Ehdr *) buf; /* Is it ELF*/ if ((elfh->e_ident[0] != 0x7f) || (elfh->e_ident[1] != 'E') || (elfh->e_ident[2] != 'L') || (elfh->e_ident[3] != 'F')) { printf("\nUnrecongised File Format"); goto cl; } /* * read program headers and print */ size = elfh->e_phnum * elfh->e_phentsize; p = malloc(size); lseek(fd, elfh->e_phoff, SEEK_SET); ret = read(fd, p, size); if (ret != size) { printf("\nCannot read Program Header"); goto cl; } elfphdr = (Elf32_Phdr *)p; for (i = 0; i < elfh->e_phnum; i++) { if (elfphdr->p_type == PT_NOTE) { unsigned char *pdata; struct note { unsigned int namesz; unsigned int descsz; unsigned int type; }; struct note *not; int pad; pdata = malloc(elfphdr->p_filesz); lseek(fd, elfphdr->p_offset, SEEK_SET); ret = read(fd, pdata, elfphdr->p_filesz); not = (struct note *) pdata; printf("\n%s", pdata + sizeof (*not)); pad = 4 - (not->namesz % 4); if (not->type == NT_PRSTATUS) { struct elf_prstatus *prs; prs = (struct elf_prstatus *)(pdata + sizeof(*not) + not->namesz + pad); printf("\nProgram Received %d", prs->pr_cursig); printf("\nPending Signals %08x", prs->pr_sigpend); printf("\nHold Signals %08x", prs->pr_sighold); printf("\nPID of the process %d", prs->pr_pid); printf("\nPPID of the process %d", prs->pr_ppid); printf("\nEBX: %08x", prs->pr_reg[0]); printf("\nECX: %08x", prs->pr_reg[1]); printf("\nEDX: %08x", prs->pr_reg[2]); printf("\nESI: %08x", prs->pr_reg[3]); printf("\nEDI: %08x", prs->pr_reg[4]); printf("\nEBP: %08x", prs->pr_reg[5]); printf("\nEAX: %08x", prs->pr_reg[6]); printf("\nXDS: %08x", prs->pr_reg[7]); printf("\nXES: %08x", prs->pr_reg[8]); printf("\nXFS: %08x", prs->pr_reg[9]); printf("\nXGS: %08x", prs->pr_reg[10]); printf("\nORG_EAX: %08x", prs->pr_reg[11]); printf("\nEIP: %08x", prs->pr_reg[12]); printf("\nECS: %08x", prs->pr_reg[13]); printf("\nEFLAGS: %08x", prs->pr_reg[14]); printf("\nESP: %08x", prs->pr_reg[15]); printf("\nXSS: %08x", prs->pr_reg[16]); pdata = pdata + sizeof(*not) + not->namesz + pad + sizeof(struct elf_prstatus); } not = (struct note *)pdata; if (not->type == NT_PRPSINFO) { struct elf_prpsinfo *prs; printf("\n\nNT_PRPSINF\n"); pad = 4 - (not->namesz % 4); prs = (struct elf_prpsinfo *)(pdata + sizeof(*not) + not->namesz + pad); printf("\nName of the Exe %s", prs->pr_fname); } // free(pdata); } elfphdr++; } free(p); printf("\n\n"); cl: close(fd); return 0; } </code></pre>
Tags
Title
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. POHow to extract EBP and ESP from Core Dump?
  singulars
  PostTypePostTypeId
  PTQuestion
PostTypePostTypeId
1. PTAnswer
UserLastEditorUserId
1. USkgibm
UserOwnerUserId
1. USmohanreddykv
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. POHow to extract EBP and ESP from Core Dump?
  singulars
  PostTypePostTypeId
  PTQuestion
PostsParentIdCreationDate
1. This table or related slice is empty.
VotesPostIdCreationDate
1. VO
  singulars
  PostPostId
  PO
  UserUserId
  This table or related slice is empty.
  VoteTypeVoteTypeId
  VTUpMod
2. VO
  singulars
  PostPostId
  PO
  UserUserId
  This table or related slice is empty.
  VoteTypeVoteTypeId
  VTAcceptedByOriginator
CommentsPostId

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.