# Anatomy of Core Dump Image

[中文]

Core dump files are generated in ELF format, which provides comprehensive information regarding the software's state at the moment the crash occurs, including CPU registers and memory contents.

The memory state embeds a snapshot of all tasks mapped in the memory space of the program. The CPU state contains register values when the core dump has been generated. The core dump file uses a subset of the ELF structures to register this information.

Loadable ELF segments are used to store the process' memory state, while ELF notes (`ELF.PT_NOTE`) are used to store the process' metadata (e.g., PID, registers, signal etc). In particular, the CPU's status is stored in a note with a special name and type (`CORE`, `NT_PRSTATUS type`).

Here is an overview of the core dump layout:

Core Dump ELF Image Format

Note

The format of the image file shown in the above pictures represents the current version of the image and can be changed in future releases.

# Overview of Implementation

The figure below describes some basic aspects related to the implementation of the core dump:

Core Dump Implementation Overview

Note

The diagram above hides some details and represents the current implementation of the core dump which can be changed later.

Was this page helpful?

- Thank you! We received your feedback.
- If you have any comments, fill in Espressif Documentation Feedback Form.

- We value your feedback.
- Let us know how we can improve this page by filling in Espressif Documentation Feedback Form.