Xref: utzoo comp.sys.att:5023 unix-pc.general:1945
Path: utzoo!utgpu!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!bloom-beacon!husc6!purdue!haven!umbc3!alex
From: alex@umbc3.UMD.EDU (Alex S. Crain)
Newsgroups: comp.sys.att,unix-pc.general
Subject: Re: 3B1 problem: mysterious core files in /etc/lddrv
Message-ID: <1494@umbc3.UMD.EDU>
Date: 27 Dec 88 19:55:52 GMT
References: <1988Dec23.021443.21872@ziebmef.uucp> <460@manta.pha.pa.us>
Reply-To: alex@umbc3.UMD.EDU (Alex S. Crain)
Organization: University of Maryland, Baltimore County
Lines: 27

In article <460@manta.pha.pa.us> brant@manta.pha.pa.us (Brant Cheikes) writes:

>If you know where to look, you can find the user structure, described in
><sys/user.h>, in the core file.  The user structure tells you all sorts
>of neat things about the core-dumping process, including its name.
>In C, first
>  cfp = fopen(core_name, "r");

>  fseek(cfp, (long)U_OFFSET, 0);
>where U_OFFSET is defined in <sys/param.h>.  Now you can just
>  { struct user u; /* from <sys/user.h> */
>    fread(&u, sizeof(u), 1, cfp);
>    /* print out useful data in u */
>  }

	You could also use that wonderful binary inspector, GNU emacs (if
you have it) with

	emacs core_name
	ESC-ESC (goto-char 2304)

where 2304 is decamil for 0x900 (U_OFFSET).
-- 
					:alex
Alex Crain
Systems Programmer			alex@umbc3.umd.edu
Univ Md Baltimore County		nerwin!alex@umbc3.umd.edu