CORE(5) File Formats Manual CORE(5)

corememory image file format

#include <sys/param.h>

A small number of signals which cause abnormal termination of a process also cause a record of the process's in-core state to be written to disk for later examination by one of the available debuggers. (See sigaction(2).) This memory image is written to a file named by default core.pid, where pid is the process ID of the process, in the /cores directory, provided the terminated process had write permission in the directory, and the directory existed.

The maximum size of a core file is limited by setrlimit(2). Files which would be larger than the limit are not created.

The core file consists of the Mach-O(5) header as described in the ⟨mach-o/loader.h⟩ file. The remainder of the core file consists of various sections described in the Mach-O(5) header.

Core dumps are disabled by default under Darwin/macOS. To re-enable core dumps, do one of the following

* For subsequent processes spawned by launchd and their child processes, a privileged user can issue the command

# launchctl limit core unlimited

* For susequent processes spawned by a shell, use ulimit(1) or limit(1) depending upon the shell.

% ulimit -c unlimited
or
% limit coredumpsize unlimited

To disable core dumps, set the limit to 0 using one of the aforementioned ways.

lldb(1), setrlimit(2), sigaction(2), launchd.conf(5), launchd.plist(5), Mach-O(5), sysctl(8)

A core file format appeared in Version 1 AT&T UNIX.

December 22, 2020 macOS 14.4