poka.sh

 Docs

CORE

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

ELF Core Dump Preview.

At a glance
Purpose A Linux ELF core dump: a crashed process's memory segments and notes (registers, process information, mapped files).
Extensions .core
Poka parser poka-coredump
Viewer poka-tree-viewer
Depth tier Parser with a shared viewer (see Depth tiers)
Breadth tier B4 Summary (see Breadth tiers)

How much Poka reads

B4 Summary. The container and metadata are read and summarised (counts, properties, structure), but the main content is not rendered.

Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-coredump/src/main.rs (527 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has no .core sample. Covers .core. The tree reads the ELF header, program headers and notes and shows the process (command, command line, PID, parent PID, crash signal), the thread count, the memory segments with totals, and the mapped files. Judgement: B4: the dump's process information is decoded, but memory, registers and stacks are not.

What Poka does not read

  • Thread registers (NT_PRSTATUS contents) are not shown
  • No stack is unwound and memory contents are not shown
  • The auxiliary vector and signal information are noted, not decoded
  • Only the first 100 segments and 100 mapped files are listed

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

  • goblin (candidate; MIT; Rust; https://github.com/m4b/goblin) — ELF32/64 parser; docs.rs shows note iterators and NT_PRSTATUS/NT_PRPSINFO/NT_FILE constants, but decoding register sets is left to the caller.
  • LIEF (candidate; Apache-2.0; C++; https://github.com/lief-project/LIEF) — Executable-format library with C++, Python and Rust APIs; a CorePrStatus class and an ELF coredump tutorial appeared in results (core support not fully confirmed from the repo page).

Sources

  • parsers/poka-coredump/src/main.rs
  • parsers/poka-coredump/plugin.json