lkml.org 
[lkml]   [1996]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: magic file entry to understand core dumps
    Andrew C. Esh wrote:

    > [andrewes@andrewes andrewes]$ file core
    > core: ELF 32-bit LSB core file i386 (386 and up) Version 1
    >
    > It knows it's a core file, but doesn't give the "executable name" that
    > you need in order to start gdb.
    >
    > Solution 2: Add an entry to /etc/magic to allow "file" to decode an
    > ELF core file. This may not be possible, if "file" is too simple to
    > deal with the complexities of finding the executable name. BTW: My
    > "file" is about a year old. I can't tell what version it is. It's ELF.

    I don't know whether it works 100% of the time or not, but the magic file
    from Debian-1.1 seems to do this ok.

    bash$ file core
    core: ELF 32-bit LSB core file of 'dump' (signal 11), Intel 80386, version 1, stripped

    The relevant rule is:

    #------------------------------------------------------------------------------
    # elf: file(1) magic for ELF executables
    #
    # We have to check the byte order flag to see what byte order all the
    # other stuff in the header is in.
    #
    # Byte order is probably big-endian for MIPS RS3000 and Amdahl.
    # MIPS RS3000 may also be for MIPS RS2000.
    #
    # updated by Daniel Quinlan (quinlan@yggdrasil.com)
    0 string \177ELF ELF
    >4 byte 0 invalid class
    >4 byte 1 32-bit
    >4 byte 2 64-bit
    >5 byte 0 invalid byte order
    >5 byte 1 LSB
    >>16 leshort 0 no file type,
    >>16 leshort 1 relocatable,
    >>16 leshort 2 executable,
    >>16 leshort 3 shared object,
    # replaced by new entry from Peter Tobias <tobias@server.et-inf.fho-emden.de>
    #>>16 leshort 4 core file,
    >>16 leshort 4 core file
    >>>576 string >\0 of '%s'
    >>>400 lelong >0 (signal %d),
    # end of replacement entry
    >>16 leshort &0xff00 processor-specific,
    >>18 leshort 0 no machine,
    >>18 leshort 1 AT&T WE32100 - invalid byte order,
    >>18 leshort 2 SPARC - invalid byte order,
    >>18 leshort 3 Intel 80386,
    >>18 leshort 4 Motorola 68000 - invalid byte order,
    >>18 leshort 5 Motorola 88000 - invalid byte order,
    >>18 leshort 6 Intel 80486,
    >>18 leshort 7 Intel 80860,
    >>18 leshort 8 MIPS RS3000,
    >>18 leshort 9 Amdahl,
    >>20 lelong 0 invalid version
    >>20 lelong 1 version 1
    >>36 lelong 1 MathCoPro/FPU/MAU Required
    >5 byte 2 MSB
    >>16 beshort 0 no file type,
    >>16 beshort 1 relocatable,
    >>16 beshort 2 executable,
    >>16 beshort 3 shared object,
    >>16 beshort 4 core file,
    >>16 beshort &0xff00 processor-specific,
    >>18 beshort 0 no machine,
    >>18 beshort 1 AT&T WE32100,
    >>18 beshort 2 SPARC,
    >>18 beshort 3 Intel 80386 - invalid byte order,
    >>18 beshort 4 Motorola 68000,
    >>18 beshort 5 Motorola 88000,
    >>18 beshort 6 Intel 80486 - invalid byte order,
    >>18 beshort 7 Intel 80860,
    >>18 beshort 8 MIPS RS3000,
    >>18 leshort 9 Amdahl,
    >>20 belong 0 invalid version
    >>20 belong 1 version 1
    >>36 belong 1 MathCoPro/FPU/MAU Required



    regards
    Terry


    \
     
     \ /
      Last update: 2005-03-22 13:37    [W:0.022 / U:20.416 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site