Virtual memory addresses of objdump vs /proc/pid/maps?

Question

I'm trying to understand where exactly does the executable assembly of a program end up, when a program is loaded/running. I found two resources talking about this, but they are somewhat difficult to read: - Understanding ELF using readelf and objdump Linux article (code formatting is messed up) - Michael Guyver, Some Assembly Required*: Relocations, Relocations (lots of assembly which I'm not exactly proficient in) So, here's a brief example; I'm interested where does the executable section of the `tail` program end up. Basically, objdump tells me this: ``` $ objdump -dj .text /usr/bin/tail | head -10 /usr/bin/tail: file format elf32-i386 Disassembly of section .text: 08049100 <.text>: 8049100: 31 ed xor %ebp,%ebp 8049102: 5e pop %esi 8049103: 89 e1 mov %esp,%ecx ... ``` I'm assuming I'd see calls to `tail`'s '`main()`' be made here, had symbols not been stripped. Anyways, the start of the executable section is, according to this, `0x08049100`; I'm interested in where it ends up even…

Accepted Answer

The short answer is that loadable segments get mapped into memory based on the ELF program headers with type PT_LOAD.

PT_LOAD - The array element specifies a loadable segment, described by p_filesz and p_memsz. The bytes from the file are mapped to the beginning of the memory segment. If the segment's memory size (p_memsz) is larger than the file size (p_filesz), the ``extra'' bytes are defined to hold the value 0 and to follow the segment's initialized area. The file size may not be larger than the memory size. Loadable segment entries in the program header table appear in ascending order, sorted on the p_vaddr member.

For example, on my CentOS 6.4:

```
objdump -x `which tail`

Program Header:
    LOAD off    0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12
         filesz 0x0000e4d4 memsz 0x0000e4d4 flags r-x
    LOAD off    0x0000e4d4 vaddr 0x080574d4 paddr 0x080574d4 align 2**12
         filesz 0x000003b8 memsz 0x0000054c flags rw-
```

And from /proc/pid/maps:

```
cat /proc/2671/maps | grep `which tail`
08048000-08057000 r-xp 00000000 fd:00 133669     /usr/bin/tail
08057000-08058000 rw-p 0000e000 fd:00 133669     /usr/bin/tail
```

You will notice there is a difference between what maps and objdump says for the load address for subsequent sections, but that has to do with the loader accounting how much memory the section takes up as well as the alignment field. The first loadable segment is mapped in at 0x08048000 with a size of 0x0000e4d4, so you'd expect it to go from 0x08048000 to 0x080564d4, but the alignment says to align on 2^12 byte pages. If you do the math you end up at 0x8057000, matching /proc/pid/maps. So the second segment is mapped in at 0x8057000 and has a size of 0x0000054c (ending at 0x805754c), which is aligned to 0x8058000, matching /proc/pid/maps.

Virtual memory addresses of objdump vs /proc/pid/maps?

Solution

Problem

Related problems