How about these (non-kssl) patches?

[Neil Stevens]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Monday September 30, 2002 12:52, Alex Zepeda wrote:
> On Mon, Sep 30, 2002 at 02:19:03PM +0200, Stephan Kulow wrote:
> > Taking that later linux kernel output core.<pid> for multithreaded
> > programs. Here it becomes ugly to use patterns. It really should. Core
> > files have a very simple ELF signature. I would remove the whole
> > Patterns line.
>
> Well.  I'm all for removing the patterns (not much use for me since all
> my core dumps end up in one directory anyhow), however not everyone
> using KDE uses ELF binaries.  Certainly Darwin users don't, and probably
> won't, ever.  Then there's NetBSD, I believe some of the platforms it
> supports still use a.out.. I'm unsure about OpenBSD.  I'm sure there are
> signatures for all those core dumps, can our mimemagic stuff handle
> that?

The magic format plus extensions used by KDE is reasonably powerful.  It 
can easily handle the typical format of a C struct, which should be 
sufficient for working with data from a Unix kernel.  (insert gratuitous 
jab at Linux /proc :-)

Now to use the mighty google to look around:

http://www.tac.eu.org/cgi-bin/man-cgi?core+5

NetBSD's a.out core file format does have a magic number in the header.  
Not having a NetBSD install handy, I can't tell you what that number 
actually is.

http://www.doc.ic.ac.uk/~mac/manuals/hpux-manual-pages/hpux/usr/man/man4/core.4.html

HPUX's cores don't seem to have one, unless the CORE_FORMAT id is something 
reasonably unique.

http://developer.apple.com/techpubs/macosx/DeveloperTools/MachORuntime/8rt_file_format/_Mach_O_Hea_a_Structure.html

Darwin uses Mach-O format for their cores, and that appears to have a magic 
number.

http://resin.csoft.net/cgi-bin/man.cgi?section=5&topic=core

The OpenBSD man page is less useful, but points to headers for anyone who 
has them handy.

All in all, it looks like most kernels' core files should be supportable by 
magic.
- -- 
Neil Stevens - neil at qualityassistant.com
"I always cheer up immensely if an attack is particularly wounding
because I think, well, if they attack one personally, it means they
have not a single political argument left." - Margaret Thatcher
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE9mLEKf7mnligQOmERAjjIAKCE6EPMs83V0LT3JhuGeaJ0+hdgHQCeJ/Ge
E2JFfOzVTsfyJaGQ2uKvzXE=
=vfH+
-----END PGP SIGNATURE-----