it will support coredump attach to the binary?

[herneymolly-creator]

when i use qiling to analysis the binary with coredump file,i found the qiling framework doesn't support load coredump file,but gemini tell me it can do,i didn't found any real code to do it, it will comming soon?

[xwings]

Thanks for asking. Qiling does not currently have a supported core-dump loader or an attach-to-core workflow.

The ELF loader can load normal executable/shared-object ELF files, but it does not reconstruct process state from an ET_CORE file: memory mappings, register notes, thread state, signal info, auxv, file-backed mappings, etc. So if another tool said Qiling can directly load a core dump, that does not match the code we have today.

For now, the practical options are:

• Use gdb, readelf, eu-readelf, or similar tools for post-mortem core inspection.
• If you only need a very specific experiment, write a Qiling script that manually maps the relevant dumped memory ranges with ql.mem.map() / ql.mem.write() and sets registers before running. That is not a general core-dump attach feature, though.

Could you share a bit more about the workflow you want?

• target OS and architecture
• how the core dump was produced
• whether the process is single-threaded or multi-threaded
• whether you want inspection only, or to resume emulation from the crash point

Also, if you are testing against an older release, please confirm whether the same behavior exists on latest main.

---

🤖 generated by review.py (codex)