int main(int argc, char *argv[]) { return 0; }
Given the above C program, I get the following result with clang test.c ; strace ./a.out clang test.c ; strace ./a.out .
execve("./a.out", ["./a.out"], [/* 36 vars */]) = 0 brk(0) = 0x1a06000 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f785c40f000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=78590, ...}) = 0 mmap(NULL, 78590, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f785c3fb000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\37\2\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1840928, ...}) = 0 mmap(NULL, 3949248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f785be2a000 mprotect(0x7f785bfe5000, 2093056, PROT_NONE) = 0 mmap(0x7f785c1e4000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ba000) = 0x7f785c1e4000 mmap(0x7f785c1ea000, 17088, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f785c1ea000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f785c3fa000 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f785c3f8000 arch_prctl(ARCH_SET_FS, 0x7f785c3f8740) = 0 mprotect(0x7f785c1e4000, 16384, PROT_READ) = 0 mprotect(0x600000, 4096, PROT_READ) = 0 mprotect(0x7f785c411000, 4096, PROT_READ) = 0 munmap(0x7f785c3fb000, 78590) = 0 exit_group(0) = ? +++ exited with 0 +++
Something puzzled me:
- What does a line ending in
0x7f785c40f000 mean / do mean? - Why is
3949248 in mmap when libc.so is 1840928 big? - Where
mprotect address used in mprotect ? - Where does
mmap address come from if it's not NULL ? - What 4k and 8k memory are allocated by
mmap right before arch_prctl ?