{"record":{"id":"62eedad6560b0985","repo":"go-delve/delve","slug":"reading-nt-file-header-v","errorCode":null,"errorMessage":"reading NT_FILE header: %v","messagePattern":"reading NT_FILE header: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proc/core/linux_core.go","lineNumber":353,"sourceCode":"\t\tdefault:\n\t\t\treturn nil, errors.New(\"unsupported machine type\")\n\t\t}\n\t\tif err := binary.Read(descReader, binary.LittleEndian, note.Desc); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading NT_PRSTATUS: %v\", err)\n\t\t}\n\tcase elf.NT_PRPSINFO:\n\t\tnote.Desc = &linuxPrPsInfo{}\n\t\tif err := binary.Read(descReader, binary.LittleEndian, note.Desc); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading NT_PRPSINFO: %v\", err)\n\t\t}\n\tcase _NT_FILE:\n\t\t// No good documentation reference, but the structure is\n\t\t// simply a header, including entry count, followed by that\n\t\t// many entries, and then the file name of each entry,\n\t\t// null-delimited. Not reading the names here.\n\t\tdata := &linuxNTFile{}\n\t\tif err := binary.Read(descReader, binary.LittleEndian, &data.linuxNTFileHdr); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading NT_FILE header: %v\", err)\n\t\t}\n\t\tfor i := 0; i < int(data.Count); i++ {\n\t\t\tentry := &linuxNTFileEntry{}\n\t\t\tif err := binary.Read(descReader, binary.LittleEndian, entry); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"reading NT_FILE entry %v: %v\", i, err)\n\t\t\t}\n\t\t\tdata.entries = append(data.entries, entry)\n\t\t}\n\t\tnote.Desc = data\n\tcase _NT_X86_XSTATE:\n\t\tif machineType == _EM_X86_64 {\n\t\t\tvar fpregs amd64util.AMD64Xstate\n\t\t\tif err := amd64util.AMD64XstateRead(desc, true, &fpregs, 0); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tnote.Desc = &fpregs\n\t\t}\n\tcase _NT_AUXV, elfwriter.DelveHeaderNoteType, elfwriter.DelveThreadNodeType:","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/pkg/proc/core/linux_core.go#L335-L371","documentation":"This error is raised when binary.Read fails to decode the NT_FILE note header (linuxNTFileHdr: count of mapped-file entries plus page-count fields) from the note descriptor. Delve throws it when the descriptor is too short or corrupt, meaning the mapped-file table of the core cannot be parsed.","triggerScenarios":"A core file whose NT_FILE note descriptor ends before the header struct is complete; also triggered by corrupted descriptors where Descsz doesn't match the real NT_FILE layout.","commonSituations":"Truncated or hand-modified core dumps, cores produced by nonstandard dumpers that shrink the NT_FILE note, corrupted CI artifact downloads.","solutions":["Re-capture the core dump and verify with readelf -n <core> that NT_FILE parses.","Use a standard dumper (kernel-generated core or gcore) instead of a custom/trimmed dump tool.","Compare the note's Descsz against the expected header+entries size to detect a bad producer.","If the NT_FILE note is optional for your analysis, regenerate with a dumper that omits it cleanly rather than truncating."],"exampleFix":"// before\n// custom dumper wrote only partial NT_FILE note\ndesc := buf[:len(buf)/2]\n// after\nhdrSize := 16 // linuxNTFileHdr size on 64-bit\nif len(desc) < hdrSize {\n    return fmt.Errorf(\"NT_FILE note truncated: need %d bytes, have %d\", hdrSize, len(desc))\n}","handlingStrategy":"validation","validationCode":"// Verify the NT_FILE note is present and self-consistent via readelf output:\nout, err := exec.Command(\"readelf\", \"-n\", corePath).Output()\nif err != nil || !bytes.Contains(out, []byte(\"NT_FILE\")) {\n    return fmt.Errorf(\"core %s missing or corrupt NT_FILE note\", corePath)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use standard dumpers (kernel core_pattern, gcore) that write well-formed NT_FILE notes.","Do not post-process/trim core files without recomputing note sizes.","Validate dumps with readelf -n before archiving to CI artifact stores.","Keep dumper and kernel versions consistent across your fleet."],"tags":["core-dump","elf","binary-decoding","memory-maps"],"backgroundTag":"core-note-decode-failed","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}