1

On a Ubuntu 32-bit machine, I read out the memory map of a process which is a simple C program I wrote. I notice there are three memory region allocated for /malloc/malloc_example which is the path to my binary. A few questions:

1.What are the meanings of these three memory regions? (The second one looks like stack)

2.Similarly, what are the meanings of the three memory regions for /lib/i386-linux-gnu/libc-2.15.so?

3.What is the purpose of [vdso] region?

4.What is the purpose of [stack] region? (I assume that is not the actual stack of the main function because program stack normally starts at 0x0804xxxx)

$cat /proc/27429/maps 
08048000-08049000 r-xp 00000000 08:01 292930     /malloc/malloc_example
08049000-0804a000 r-xp 00000000 08:01 292930     /malloc/malloc_example
0804a000-0804b000 rwxp 00001000 08:01 292930     /malloc/malloc_example
b7e05000-b7e07000 rwxp 00000000 00:00 0 
b7e07000-b7faa000 r-xp 00000000 08:01 7311       /lib/i386-linux-gnu/libc-2.15.so
b7faa000-b7fac000 r-xp 001a3000 08:01 7311       /lib/i386-linux-gnu/libc-2.15.so
b7fac000-b7fad000 rwxp 001a5000 08:01 7311       /lib/i386-linux-gnu/libc-2.15.so
b7fad000-b7fb0000 rwxp 00000000 00:00 0 
b7fb0000-b7fc7000 r-xp 00000000 08:01 7416       /lib/i386-linux-gnu/libpthread-2.15.so
b7fc7000-b7fc8000 r-xp 00016000 08:01 7416       /lib/i386-linux-gnu/libpthread-2.15.so
b7fc8000-b7fc9000 rwxp 00017000 08:01 7416       /lib/i386-linux-gnu/libpthread-2.15.so
b7fc9000-b7fcb000 rwxp 00000000 00:00 0 
b7fd9000-b7fdd000 rwxp 00000000 00:00 0 
b7fdd000-b7fde000 r-xp 00000000 00:00 0          [vdso]
b7fde000-b7ffe000 r-xp 00000000 08:01 7612       /lib/i386-linux-gnu/ld-2.15.so
b7ffe000-b7fff000 r-xp 0001f000 08:01 7612       /lib/i386-linux-gnu/ld-2.15.so
b7fff000-b8000000 rwxp 00020000 08:01 7612       /lib/i386-linux-gnu/ld-2.15.so
bffdf000-c0000000 rwxp 00000000 00:00 0          [stack]
drdot
  • 3,215
  • 9
  • 46
  • 81
  • Related: [What are vdso and vsyscall](http://stackoverflow.com/questions/19938324/what-are-vdso-and-vsyscall) – Mark Plotnick Jul 25 '16 at 00:50
  • Why not [read the documentation](http://man7.org/linux/man-pages/man5/proc.5.html) first? (About one fifth down, look for `/proc/[pid]/maps`.) Then, clarify your question as to what is still unclear. Hints: 3) Again, [read the documentation on vdso](http://man7.org/linux/man-pages/man7/vdso.7.html). 4. You assume wrong. – Nominal Animal Jul 25 '16 at 02:32
  • Does this answer your question? [Understanding Linux /proc/pid/maps or /proc/self/maps](https://stackoverflow.com/questions/1401359/understanding-linux-proc-pid-maps-or-proc-self-maps) – codeforester Aug 30 '21 at 20:09

1 Answers1

0

First,we should know the mean of every column.The first column means the start and end address in virtual memory.The second column means this sector's authority,r = read,w = write,x = executable,s = share,p = private.The third column means address offset in mapping file.The fourth column means mapping file's major device number and minor device number.The fifth column means number of inode.The last means name of mapping file.

So,there are three memory region for some path is because those sector have different authority.Some sector is code sector,this sector have the r+w+x authority.Some is read-only data sector,other maybe read-write data sector.Next reason is the different offset in mapping file.You can see in this two line:

b7fb0000-b7fc7000 r-xp 00000000 08:01 7416       /lib/i386-linux-gnu/libpthread-2.15.so
b7fc7000-b7fc8000 r-xp 00016000 08:01 7416       /lib/i386-linux-gnu/libpthread-2.15.so

the offset in different,it means the two sector is from the same file,but different location.

stack sector is this progress's stack,stack sector keep the local data.

vspd means Virtual Dynamic Shared Object,it is a .so file,it not store in disk but kernel.When program start running,kernel will map memory page(stroe .so file) to program's memory.You can use command ldd /bin/bash to get more information.

BobWanghz
  • 58
  • 3
  • can you be more specific about the three lines of each library? – drdot Jul 25 '16 at 03:08
  • Take `/lib/i386-linux-gnu/libc-2.15.so` for exmple,the authority of 'r-xp' is this library's code.sector,store the binary executable instruction.There are two code sector from `/lib/i386-linux-gnu/libc-2.15.so` ,offset is 00000000 and 001a3000.The authority of 'rwxp' is this library's data sector,store pragram global variable. – BobWanghz Jul 25 '16 at 04:12
  • I think (no sure) is compiler will not load all of library,but load some part of it.This two different offset in mapping file(this lib). – BobWanghz Jul 25 '16 at 04:18