--- name: "core" section: "5" platform: "openbsd" package: "man" version: "8.0-current-20261101" release: "OpenBSD 8.0-current (2026-11-01)" platforms: ["linux", "freebsd", "openbsd", "macos"] url: "https://new.carta.tech/core/5" --- # core(5) memory image file format ## NAME **core** – memory image file format ## SYNOPSIS **#include \** **#include \** ## DESCRIPTION A small number of signals which cause abnormal termination of a process also cause a record of the process's in-core state to be written to disk for later examination by one of the available debuggers (see [sigaction(2)](/sigaction/2.md)). By default, this memory image is written to a file named *programname.core* in the working directory, provided the terminated process had write permission in the directory, and the terminated process either had an effective user ID of zero or had never changed user or group ID. See the description of KERN\_NOSUIDCOREDUMP in [sysctl(2)](/sysctl/2.md) for other options. The maximum size of a *programname.core* file is limited by [setrlimit(2)](/setrlimit/2.md). Files which would be larger than the limit are not created. The *programname.core* file is in the ELF binary file format with an *e\_type* of ET\_CORE. It has no section header table and a segment header that contains PT\_LOAD and PT\_NOTE segments that describe the state of the process when terminated. The PT\_LOAD segments hold images of the process memory when it was terminated. Device mappings are excluded, as are read-only mappings that do not have private mapping changes. Each segment's *p\_vaddr*, *p\_memsz*, and *p\_flags* specify the address, size, and access protection of the memory segment it describes. The PT\_NOTE segment contains notes describing the kernel state and CPU registers of each thread in the process. Notes describing the process as a whole have the name “OpenBSD”. An NT\_OPENBSD\_PROCINFO note is included containing an *elfcore\_procinfo* structure with information about the kernel state of the process. An NT\_OPENBSD\_AUXV note is included containing a copy of the original process environment strings. On sparc64, an NT\_OPENBSD\_WCOOKIE note is included containing the process's ‘window cookie’. Notes describing the individual threads in the process have names in the format “OpenBSD@%d” where the suffix is the thread ID. For each thread, an NT\_OPENBSD\_REGS note is included containing the state of the regular registers of the thread and, on architectures other than luna88k, an NT\_OPENBSD\_FPREGS note is also included containing the state of the floating-point registers of the thread. ## SEE ALSO [gdb(1)](/gdb/1.md), [setrlimit(2)](/setrlimit/2.md), [sigaction(2)](/sigaction/2.md), [sysctl(2)](/sysctl/2.md) ## HISTORY A **core** file format appeared in Version 1 AT&T UNIX. OpenBSD 2.0 started using the ELF format for some architectures. All architectures used ELF starting in OpenBSD 5.4. ## CAVEATS Programs which are started with either the set-user-ID or set-group-ID bits set, or which change their UID or GID after starting, will normally not dump core. This is to prevent sensitive information from inadvertently ending up on disk. This behaviour can be changed (for debugging purposes) by changing the kern.nosuidcoredump [sysctl(2)](/sysctl/2.md) variable to the right settings.