How to parse the /proc/maps file in order to read the virtual memory.
Camilo Valencia Padilla
Cofundador de RedAzul | BinnStart | Desarrollador de Software | Emprendedor Tecnológico | Apasionado por la Mecatrónica
The following is an excerpt from the man manual, which can be obtained by running the command (man 5 proc).
proc/[pid]/map
A file containing the currently mapped memory regions and their access permissions. See mmap(2) for some further information about memory mappings.
The format of the file is:
address perms offset dev inode pathname
00400000-00452000 r-xp 00000000 08:02 173521 /usr/bin/dbus-daemon
00651000-00652000 r--p 00051000 08:02 173521 /usr/bin/dbus-daemon
00652000-00655000 rw-p 00052000 08:02 173521 /usr/bin/dbus-daemon
00e03000-00e24000 rw-p 00000000 00:00 0 [heap]
00e24000-011f7000 rw-p 00000000 00:00 0 [heap]
...
35b1800000-35b1820000 r-xp 00000000 08:02 135522 /usr/lib64/ld-2.15.so
35b1a1f000-35b1a20000 r--p 0001f000 08:02 135522 /usr/lib64/ld-2.15.so
35b1a20000-35b1a21000 rw-p 00020000 08:02 135522 /usr/lib64/ld-2.15.so
35b1a21000-35b1a22000 rw-p 00000000 00:00 0
35b1c00000-35b1dac000 r-xp 00000000 08:02 135870 /usr/lib64/libc-2.15.so
35b1dac000-35b1fac000 ---p 001ac000 08:02 135870 /usr/lib64/libc-2.15.so
35b1fac000-35b1fb0000 r--p 001ac000 08:02 135870 /usr/lib64/libc-2.15.so
35b1fb0000-35b1fb2000 rw-p 001b0000 08:02 135870 /usr/lib64/libc-2.15.so
...
f2c6ff8c000-7f2c7078c000 rw-p 00000000 00:00 0 [stack:986]
...
7fffb2c0d000-7fffb2c2e000 rw-p 00000000 00:00 0 [stack]
7fffb2d48000-7fffb2d49000 r-xp 00000000 00:00 0 [vdso]
The address field is the address space in the process that the mapping occupies.
La sección de dirección muestra la dirección virtual asignada por el segmento.
The perms field is a set of permissions:
r = read
w = write
x = execute
s = shared
p = private (copy on write)
Los permisos se dividen en rwxsp, r legible, w escribible, x ejecutable, s share, p privado o (copia al escribir).
The offset field is the offset into the file/whatever; dev is the device (major:minor); inode is the inode on that device. 0 indicates that no inode is associated with the memory region, as would be the case with BSS (uninitialized data).
El desplazamiento se refiere al desplazamiento del segmento asignado en el archivo / otro dispositivo. Inode se refiere al nodo de inodo del archivo o dispositivo.0 significa que no hay ningún inodo asociado a este segmento de memoria.
The pathname field will usually be the file that is backing the mapping. For ELF files, you can easily coordinate with the offset field by looking at the Offset field in the ELF program headers (readelf -l).
El nombre de la ruta es la ruta del archivo asociada con el segmento de memoria. Para archivos ELF, puede sincronizar el campo de desplazamiento y el campo OFFSET en la cabecera del archivo ELF a través de realelf-1.
There are additional helpful pseudo-paths:
[stack] The initial process's (also known as the main thread's) stack.
Hilo principal / pila de procesos
[stack:<tid>] (since Linux 3.4) A thread's stack (where the <tid> is a thread ID). It corresponds to the /proc/[pid]/task/[tid]/ path.
Hilo de pila.
[vdso] The virtual dynamically linked shared object.
Objeto de mapeo dinámico virtual del núcleo
[heap] The process's heap.
El espacio de almacenamiento dinámico del proceso.
If the pathname field is blank, this is an anonymous mapping as obtained via the mmap(2) function. There is no easy way to coordinate this back to a process's source, short of running it through gdb(1), strace(1), or similar.
Si pathname está vacío, es una asignación anónima a través de la función mmap. No hay una manera fácil de obtener este campo, debe verificar el código, o gdb, strace y otros métodos similares.
Under Linux 2.0 there is no field giving pathname.
```s
Each shared library's code segment stores binary executable machine instructions, and the kernel allocates the library's ELF file code segment to virtual storage space;
The data segment of each shared library stores the global variables required for program execution. The kernel maps the data segment of the ELF file to virtual storage space;
The user code segment, which stores executable machine instructions in binary form, is the kernel that allocates the ELF file code segment to virtual storage space;
领英推荐
Above the user data segment is the code segment, which stores the global variables needed for program execution, and the kernel allocates the ELF file's data segment to virtual storage space;
Below the user data segment is the heap, which exists only when malloc is called. The kernel allocates anonymous memory to the virtual memory space, and the heap does not call malloc in the program. Does not exist;
Below the user data segment is the stack, which is the temporary data area of the process. The kernel allocates anonymous memory to virtual memory space. Stack space growth direction is from addresses high to address low
Proc/pid/maps shows the memory areas and access permissions assigned by the process. The operation set in the corresponding kernel is proc_pid_maps_op, and the specific export function is show_map. The address space of a process in the kernel is represented by a vm_area_struct, and all address spaces are stored in the linked list task->mm->mmap.