Editing Core dump (section)

=== Format ===

In older and simpler operating systems, each process had a contiguous address-space, so a dump file was sometimes simply a file with the sequence of bytes, digits,{{efn|name=decimal|Some older machines were [[Decimal computer|decimal]].}} characters{{efn|name=decimal}} or words. On other systems a dump file contained discrete records, each containing a storage address and the associated contents. On the earliest of these machines, the dump was often written by a stand-alone dump program rather than by the application or the operating system.

<!-- I doubt that this was first; please add older examples if you know of any. -->
The [[IBSYS]] monitor for the [[IBM 7090]] included a System Core-Storage Dump Program<ref>{{cite book
 | title       = IBM 7090/7094 IBSYS Operating System - Version 13 - System Monitor (IBSYS)
 | id          = C28-6248-7
 | date        = December 30, 1966
 | edition     = Eighth
 | section     = System Core-Storage Dump Program
 | section-url = http://bitsavers.org/pdf/ibm/7090/C28-6248-7_v13_IBSYS_Dec66.pdf#page=18
 | pages       = 18–20
 | url         = http://bitsavers.org/pdf/ibm/7090/C28-6248-7_v13_IBSYS_Dec66.pdf
 | publisher   = [[IBM]]
 | series      = Systems Reference Library
 | access-date = May 10, 2024
 }}
</ref> that supported post-mortem and snap dumps.

On the [[IBM System/360]], the standard operating systems wrote formatted ABEND and SNAP dumps, with the addresses, registers, storage contents, etc., all converted into printable forms. Later releases added the ability to write unformatted{{efn|In the sense that the records were binary rather than formatted for printing.}} dumps, called at that time core image dumps (also known as SVC dumps.)

In modern operating systems, a process address space may contain gaps, and it may share pages with other processes or files, so more elaborate representations are used; they may also include other information about the state of the program at the time of the dump.

In [[Unix-like]] systems, core dumps generally use the standard [[executable]] image-[[file format|format]]:
* [[a.out]] in older versions of [[Unix]],
* [[Executable and Linkable Format|ELF]] in modern [[Linux]], [[UNIX System V|System V]], [[Solaris (operating system)|Solaris]], and [[BSD]] systems,
* [[Mach-O]] in [[macOS]], ''etc.''