For example on FreeBSD:
% readelf/readelf -n strings.core Notes at offset 0x00000190 with length 0x00001d30: Owner Data size Description FreeBSD 0x00000078 NT_PRPSINFO (Process information) FreeBSD 0x000000e0 NT_PRSTATUS (Process status) FreeBSD 0x00000200 NT_FPREGSET (Floating point information) FreeBSD 0x00000018 <unknown: 7> FreeBSD 0x00000444 <unknown: 8> FreeBSD 0x00000ddc <unknown: 9> FreeBSD 0x0000048c NT_PSTATUS (Linux process status) FreeBSD 0x0000000c <unknown: 11> FreeBSD 0x00000006 NT_FPREGS (Linux floating point regset) FreeBSD 0x000000d4 NT_PSINFO (Linux process information) FreeBSD 0x00000008 <unknown: 14> FreeBSD 0x0000000c <unknown: 15> FreeBSD 0x00000114 NT_LWPSTATUS (Linux lwpstatus_t type)
Note type 10 is NT_PSTATUS on Linux and NT_PROCSTAT_VMMAP on FreeBSD. We need to check the note name ("Owner") field and decode the note type based on that, falling back to a default set if there is no name.
I've started looking at an implementation for this and will hopefully have something to review next week.
Change for review here: https://reviews.freebsd.org/D1428
The patch looks great! I just committed in [r3140]. Thanks for your work!
I made a minor change though: it seems that Linux also uses the owner name
"LINUX". Also, I added a few more Linux-specific core note types.
Related
Commit: [r3140]