title: ELF core file format
body: <p>Short of digging through GDB source, where can I find documentation about the format used to create core files?</p>
  
  <p>The <a href="https://en.wikipedia.org/wiki/Executable_and_Linkable_Format" rel="nofollow noreferrer">ELF</a> specification leaves the core file format open, so I guess this should be part of the GDB specifications! Sadly, I did not find any help in this regard from GNU's gdb documentation.</p>
  
  <p>Here's what I am trying to do: Map virtual addresses to function names in executable/libraries that comprised the running process. To do that, I would first like to figure out, from the core file, the map from virtual address space to the name of the executable file/libraries, and then dig into the relevant file to get the symbolic information.</p>
  
  <p>Now 'readelf -a core' tells me that nearly all the segments in the core file are of the type 'load' -- I'd guess these are the .text and .bss/.data segments from all the participating files, plus a stack segment. Barring these load segments, there is one note segment, but that does not seem to contain the map. So how is the information about which file a segment corresponds to, stored in the core file? Are those 'load' segments format in a particular way to include the file information?</p>