For example on FreeBSD:
% readelf/readelf -n strings.core
Notes at offset 0x00000190 with length 0x00001d30:
Owner Data size Description
FreeBSD 0x00000078 NT_PRPSINFO (Process information)
FreeBSD 0x000000e0 NT_PRSTATUS (Process status)
FreeBSD 0x00000200 NT_FPREGSET (Floating point information)
FreeBSD 0x00000018 <unknown: 7>
FreeBSD 0x00000444 <unknown: 8>
FreeBSD 0x00000ddc <unknown: 9>
FreeBSD 0x0000048c NT_PSTATUS (Linux process status)
FreeBSD 0x0000000c <unknown: 11>
FreeBSD 0x00000006 NT_FPREGS (Linux floating point regset)
FreeBSD 0x000000d4 NT_PSINFO (Linux process information)
FreeBSD 0x00000008 <unknown: 14>
FreeBSD 0x0000000c <unknown: 15>
FreeBSD 0x00000114 NT_LWPSTATUS (Linux lwpstatus_t type)
Note type 10 is NT_PSTATUS on Linux and NT_PROCSTAT_VMMAP on FreeBSD. We need to check the note name ("Owner") field and decode the note type based on that, falling back to a default set if there is no name.
I've started looking at an implementation for this and will hopefully have something to review next week.
Change for review here: https://reviews.freebsd.org/D1428
The patch looks great! I just committed in [r3140]. Thanks for your work!
I made a minor change though: it seems that Linux also uses the owner name
"LINUX". Also, I added a few more Linux-specific core note types.
Related
Commit: [r3140]