Skip to content

Instantly share code, notes, and snippets.

@scottt
Last active April 6, 2021 06:17
Show Gist options
  • Save scottt/8f7be45708fbea8b7189 to your computer and use it in GitHub Desktop.
Save scottt/8f7be45708fbea8b7189 to your computer and use it in GitHub Desktop.
Observe mmap operations performed by the dynamic linker by running "gdb -x observe-maps-on-mmap.py"
== malloc()
_dl_init_paths()
Catchpoint 1 (syscalls 'mmap' [9] 'mprotect' [10] 'munmap' [11])
Breakpoint 2 at 0x1650: file src/true.c, line 59.
Catchpoint 1 (call to syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -1,6 +1,7 @@
555555554000-55555555a000 r-xp 00000000 08:03 198934 /usr/bin/true
555555759000-55555575b000 rw-p 00005000 08:03 198934 /usr/bin/true
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
+7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffe000 rw-p 00020000 08:03 529029 /usr/lib64/ld-2.22.so
#0 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7df412e in __libc_memalign (align=align@entry=8, n=n@entry=1600) at dl-minimal.c:78
#2 0x00007ffff7df41bd in malloc (n=n@entry=1600) at dl-minimal.c:95
#3 0x00007ffff7de3d92 in _dl_init_paths (llp=0x0) at dl-load.c:689
#4 0x00007ffff7ddef07 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1190
#5 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#6 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#7 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#8 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#9 0x0000000000000001 in ?? ()
#10 0x00007fffffffdb0e in ?? ()
#11 0x0000000000000000 in ?? ()
== map in ld.so.cache
_dl_load_cache_lookup()
Catchpoint 1 (call to syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -1,6 +1,7 @@
555555554000-55555555a000 r-xp 00000000 08:03 198934 /usr/bin/true
555555759000-55555575b000 rw-p 00005000 08:03 198934 /usr/bin/true
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
+7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
#0 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7dec5a5 in _dl_sysdep_read_whole_file (file=file@entry=0x7ffff7df8761 "/etc/ld.so.cache", sizep=sizep@entry=0x7ffff7ffe080 <cachesize>, prot=prot@entry=1) at dl-misc.c:62
#2 0x00007ffff7df309c in _dl_load_cache_lookup (name=name@entry=0x5555555548b1 "libc.so.6") at dl-cache.c:199
#3 0x00007ffff7de484f in _dl_map_object (loader=0x7ffff7ffe148, name=0x5555555548b1 "libc.so.6", type=1, trace_mode=0, mode=0, nsid=<optimized out>) at dl-load.c:2066
#4 0x00007ffff7de8e42 in openaux (a=a@entry=0x7fffffffd4d8) at dl-deps.c:63
#5 0x00007ffff7deb604 in _dl_catch_error (objname=objname@entry=0x7fffffffd4d0, errstring=errstring@entry=0x7fffffffd4c8, mallocedp=mallocedp@entry=0x7fffffffd4c7, operate=operate@entry=0x7ffff7de8e10 <openaux>, args=args@entry=0x7fffffffd4d8) at dl-error.c:187
#6 0x00007ffff7de9473 in _dl_map_object_deps (map=map@entry=0x7ffff7ffe148, preloads=<optimized out>, npreloads=npreloads@entry=0, trace_mode=trace_mode@entry=0, open_mode=open_mode@entry=0) at dl-deps.c:254
#7 0x00007ffff7ddf0d8 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1604
#8 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#9 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#10 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#11 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#12 0x0000000000000001 in ?? ()
#13 0x00007fffffffdb0e in ?? ()
#14 0x0000000000000000 in ?? ()
== map in DT_NEEDED
_dl_map_object_deps()
Catchpoint 1 (call to syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -1,5 +1,6 @@
555555554000-55555555a000 r-xp 00000000 08:03 198934 /usr/bin/true
555555759000-55555575b000 rw-p 00005000 08:03 198934 /usr/bin/true
+7ffff7a1b000-7ffff7ddc000 r-xp 00000000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
#0 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7de214f in _dl_map_segments (loader=0x7fffffffce90, has_holes=true, maplength=3934784, nloadcmds=2, loadcmds=0x7fffffffcb60, type=<optimized out>, header=0x7fffffffcf20, fd=3, l=0x7ffff7ff7658) at ./dl-map-segments.h:56
#2 _dl_map_object_from_fd (name=name@entry=0x5555555548b1 "libc.so.6", fd=3, fbp=fbp@entry=0x7fffffffcf18, realname=0x7ffff7ff7640 "/lib64/libc.so.6", loader=loader@entry=0x7ffff7ffe148, l_type=l_type@entry=1, mode=0, stack_endp=0x7fffffffcf10, nsid=0) at dl-load.c:1231
#3 0x00007ffff7de43e5 in _dl_map_object (loader=0x7ffff7ffe148, name=0x5555555548b1 "libc.so.6", type=1, trace_mode=0, mode=0, nsid=<optimized out>) at dl-load.c:2200
#4 0x00007ffff7de8e42 in openaux (a=a@entry=0x7fffffffd4d8) at dl-deps.c:63
#5 0x00007ffff7deb604 in _dl_catch_error (objname=objname@entry=0x7fffffffd4d0, errstring=errstring@entry=0x7fffffffd4c8, mallocedp=mallocedp@entry=0x7fffffffd4c7, operate=operate@entry=0x7ffff7de8e10 <openaux>, args=args@entry=0x7fffffffd4d8) at dl-error.c:187
#6 0x00007ffff7de9473 in _dl_map_object_deps (map=map@entry=0x7ffff7ffe148, preloads=<optimized out>, npreloads=npreloads@entry=0, trace_mode=trace_mode@entry=0, open_mode=open_mode@entry=0) at dl-deps.c:254
#7 0x00007ffff7ddf0d8 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1604
#8 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#9 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#10 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#11 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#12 0x0000000000000001 in ?? ()
#13 0x00007fffffffdb0e in ?? ()
#14 0x0000000000000000 in ?? ()
== Holes in segments
_dl_map_segments()
if (has_holes) {
...
}
Catchpoint 1 (call to syscall mprotect), 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mprotect), 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -1,6 +1,8 @@
555555554000-55555555a000 r-xp 00000000 08:03 198934 /usr/bin/true
555555759000-55555575b000 rw-p 00005000 08:03 198934 /usr/bin/true
-7ffff7a1b000-7ffff7ddc000 r-xp 00000000 08:03 526973 /usr/lib64/libc-2.22.so
+7ffff7a1b000-7ffff7bd2000 r-xp 00000000 08:03 526973 /usr/lib64/libc-2.22.so
+7ffff7bd2000-7ffff7dd2000 ---p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
+7ffff7dd2000-7ffff7ddc000 r-xp 003b7000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
#0 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7de29a1 in _dl_map_segments (loader=0x7fffffffce90, has_holes=<optimized out>, maplength=3934784, nloadcmds=2, loadcmds=0x7fffffffcb60, type=<optimized out>, header=0x7fffffffcf20, fd=3, l=0x7ffff7ff7658) at ./dl-map-segments.h:72
#2 _dl_map_object_from_fd (name=name@entry=0x5555555548b1 "libc.so.6", fd=3, fbp=fbp@entry=0x7fffffffcf18, realname=0x7ffff7ff7640 "/lib64/libc.so.6", loader=loader@entry=0x7ffff7ffe148, l_type=l_type@entry=1, mode=0, stack_endp=0x7fffffffcf10, nsid=0) at dl-load.c:1231
#3 0x00007ffff7de43e5 in _dl_map_object (loader=0x7ffff7ffe148, name=0x5555555548b1 "libc.so.6", type=1, trace_mode=0, mode=0, nsid=<optimized out>) at dl-load.c:2200
#4 0x00007ffff7de8e42 in openaux (a=a@entry=0x7fffffffd4d8) at dl-deps.c:63
#5 0x00007ffff7deb604 in _dl_catch_error (objname=objname@entry=0x7fffffffd4d0, errstring=errstring@entry=0x7fffffffd4c8, mallocedp=mallocedp@entry=0x7fffffffd4c7, operate=operate@entry=0x7ffff7de8e10 <openaux>, args=args@entry=0x7fffffffd4d8) at dl-error.c:187
#6 0x00007ffff7de9473 in _dl_map_object_deps (map=map@entry=0x7ffff7ffe148, preloads=<optimized out>, npreloads=npreloads@entry=0, trace_mode=trace_mode@entry=0, open_mode=open_mode@entry=0) at dl-deps.c:254
#7 0x00007ffff7ddf0d8 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1604
#8 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#9 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#10 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#11 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#12 0x0000000000000001 in ?? ()
#13 0x00007fffffffdb0e in ?? ()
#14 0x0000000000000000 in ?? ()
== Process load commands
_dl_map_segments()
while (c < &loadcmds[nloadcmds]) {
...
++c;
}
Catchpoint 1 (call to syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -2,7 +2,8 @@
555555759000-55555575b000 rw-p 00005000 08:03 198934 /usr/bin/true
7ffff7a1b000-7ffff7bd2000 r-xp 00000000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7bd2000-7ffff7dd2000 ---p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
-7ffff7dd2000-7ffff7ddc000 r-xp 003b7000 08:03 526973 /usr/lib64/libc-2.22.so
+7ffff7dd2000-7ffff7dd8000 rw-p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
+7ffff7dd8000-7ffff7ddc000 r-xp 003bd000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
#0 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7de28f6 in _dl_map_segments (loader=0x7fffffffce90, has_holes=<optimized out>, maplength=<optimized out>, nloadcmds=2, loadcmds=<optimized out>, type=<optimized out>, header=<optimized out>, fd=<optimized out>, l=0x7ffff7ff7658) at ./dl-map-segments.h:90
#2 _dl_map_object_from_fd (name=name@entry=0x5555555548b1 "libc.so.6", fd=<optimized out>, fbp=fbp@entry=0x7fffffffcf18, realname=<optimized out>, loader=loader@entry=0x7ffff7ffe148, l_type=l_type@entry=1, mode=0, stack_endp=0x7fffffffcf10, nsid=0) at dl-load.c:1231
#3 0x00007ffff7de43e5 in _dl_map_object (loader=0x7ffff7ffe148, name=0x5555555548b1 "libc.so.6", type=1, trace_mode=0, mode=0, nsid=<optimized out>) at dl-load.c:2200
#4 0x00007ffff7de8e42 in openaux (a=a@entry=0x7fffffffd4d8) at dl-deps.c:63
#5 0x00007ffff7deb604 in _dl_catch_error (objname=objname@entry=0x7fffffffd4d0, errstring=errstring@entry=0x7fffffffd4c8, mallocedp=mallocedp@entry=0x7fffffffd4c7, operate=operate@entry=0x7ffff7de8e10 <openaux>, args=args@entry=0x7fffffffd4d8) at dl-error.c:187
#6 0x00007ffff7de9473 in _dl_map_object_deps (map=map@entry=0x7ffff7ffe148, preloads=<optimized out>, npreloads=npreloads@entry=0, trace_mode=trace_mode@entry=0, open_mode=open_mode@entry=0) at dl-deps.c:254
#7 0x00007ffff7ddf0d8 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1604
#8 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#9 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#10 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#11 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#12 0x0000000000000001 in ?? ()
#13 0x00007fffffffdb0e in ?? ()
#14 0x0000000000000000 in ?? ()
== Zero end of segment
Catchpoint 1 (call to syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -3,7 +3,7 @@
7ffff7a1b000-7ffff7bd2000 r-xp 00000000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7bd2000-7ffff7dd2000 ---p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7dd2000-7ffff7dd8000 rw-p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
-7ffff7dd8000-7ffff7ddc000 r-xp 003bd000 08:03 526973 /usr/lib64/libc-2.22.so
+7ffff7dd8000-7ffff7ddc000 rw-p 00000000 00:00 0
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
#0 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7de292e in _dl_map_segments (loader=0x7fffffffce90, has_holes=<optimized out>, maplength=<optimized out>, nloadcmds=2, loadcmds=<optimized out>, type=<optimized out>, header=<optimized out>, fd=<optimized out>, l=0x7ffff7ff7658) at ./dl-map-segments.h:137
#2 _dl_map_object_from_fd (name=name@entry=0x5555555548b1 "libc.so.6", fd=<optimized out>, fbp=fbp@entry=0x7fffffffcf18, realname=<optimized out>, loader=loader@entry=0x7ffff7ffe148, l_type=l_type@entry=1, mode=0, stack_endp=0x7fffffffcf10, nsid=0) at dl-load.c:1231
#3 0x00007ffff7de43e5 in _dl_map_object (loader=0x7ffff7ffe148, name=0x5555555548b1 "libc.so.6", type=1, trace_mode=0, mode=0, nsid=<optimized out>) at dl-load.c:2200
#4 0x00007ffff7de8e42 in openaux (a=a@entry=0x7fffffffd4d8) at dl-deps.c:63
#5 0x00007ffff7deb604 in _dl_catch_error (objname=objname@entry=0x7fffffffd4d0, errstring=errstring@entry=0x7fffffffd4c8, mallocedp=mallocedp@entry=0x7fffffffd4c7, operate=operate@entry=0x7ffff7de8e10 <openaux>, args=args@entry=0x7fffffffd4d8) at dl-error.c:187
#6 0x00007ffff7de9473 in _dl_map_object_deps (map=map@entry=0x7ffff7ffe148, preloads=<optimized out>, npreloads=npreloads@entry=0, trace_mode=trace_mode@entry=0, open_mode=open_mode@entry=0) at dl-deps.c:254
#7 0x00007ffff7ddf0d8 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1604
#8 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#9 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#10 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#11 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#12 0x0000000000000001 in ?? ()
#13 0x00007fffffffdb0e in ?? ()
#14 0x0000000000000000 in ?? ()
== Allocate DTV slot info list (Dynamic Thread Vector)
See https://www.akkadia.org/drepper/tls.pdf for a description of the data structure
Catchpoint 1 (call to syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -5,6 +5,7 @@
7ffff7dd2000-7ffff7dd8000 rw-p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7dd8000-7ffff7ddc000 rw-p 00000000 00:00 0
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
+7ffff7fb2000-7ffff7fb3000 rw-p 00000000 00:00 0
7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
#0 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7df412e in __libc_memalign (align=align@entry=8, n=1040) at dl-minimal.c:78
#2 0x00007ffff7df41bd in malloc (n=<optimized out>) at dl-minimal.c:95
#3 0x00007ffff7df41ee in calloc (nmemb=nmemb@entry=1040, size=size@entry=1) at dl-minimal.c:114
#4 0x00007ffff7ddcb8f in init_tls () at rtld.c:587
#5 0x00007ffff7ddf60f in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1679
#6 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#7 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#8 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#9 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#10 0x0000000000000001 in ?? ()
#11 0x00007fffffffdb0e in ?? ()
#12 0x0000000000000000 in ?? ()
== Construct static TLS block and the dtv for the initial thread
_dl_allocate_tls_storage()
Catchpoint 1 (call to syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -5,7 +5,7 @@
7ffff7dd2000-7ffff7dd8000 rw-p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7dd8000-7ffff7ddc000 rw-p 00000000 00:00 0
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
-7ffff7fb2000-7ffff7fb3000 rw-p 00000000 00:00 0
+7ffff7fb1000-7ffff7fb3000 rw-p 00000000 00:00 0
7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
#0 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7df412e in __libc_memalign (align=<optimized out>, n=n@entry=4096) at dl-minimal.c:78
#2 0x00007ffff7dee0aa in _dl_allocate_tls_storage () at dl-tls.c:367
#3 0x00007ffff7ddcbdb in init_tls () at rtld.c:620
#4 0x00007ffff7ddf60f in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1679
#5 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#6 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#7 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#8 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#9 0x0000000000000001 in ?? ()
#10 0x00007fffffffdb0e in ?? ()
#11 0x0000000000000000 in ?? ()
== Allocate DTV (Dynamic Thread Vector)
Catchpoint 1 (call to syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mmap), 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -5,7 +5,7 @@
7ffff7dd2000-7ffff7dd8000 rw-p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7dd8000-7ffff7ddc000 rw-p 00000000 00:00 0
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
-7ffff7fb1000-7ffff7fb3000 rw-p 00000000 00:00 0
+7ffff7fb0000-7ffff7fb3000 rw-p 00000000 00:00 0
7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
#0 0x00007ffff7df54da in mmap64 () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7df412e in __libc_memalign (align=align@entry=8, n=272) at dl-minimal.c:78
#2 0x00007ffff7df41bd in malloc (n=<optimized out>) at dl-minimal.c:95
#3 0x00007ffff7df41ee in calloc (nmemb=nmemb@entry=17, size=size@entry=16) at dl-minimal.c:114
#4 0x00007ffff7dee101 in allocate_dtv (result=0x7ffff7fb1700) at dl-tls.c:322
#5 _dl_allocate_tls_storage () at dl-tls.c:390
#6 0x00007ffff7ddcbdb in init_tls () at rtld.c:620
#7 0x00007ffff7ddf60f in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1679
#8 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#9 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#10 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#11 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#12 0x0000000000000001 in ?? ()
#13 0x00007fffffffdb0e in ?? ()
#14 0x0000000000000000 in ?? ()
== Change protection to Read-Only after relocation processing (libc.so)
_dl_protect_relro()
_dl_relocate_object()
Catchpoint 1 (call to syscall mprotect), 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mprotect), 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -2,7 +2,8 @@
555555759000-55555575b000 rw-p 00005000 08:03 198934 /usr/bin/true
7ffff7a1b000-7ffff7bd2000 r-xp 00000000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7bd2000-7ffff7dd2000 ---p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
-7ffff7dd2000-7ffff7dd8000 rw-p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
+7ffff7dd2000-7ffff7dd6000 r--p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
+7ffff7dd6000-7ffff7dd8000 rw-p 001bb000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7dd8000-7ffff7ddc000 rw-p 00000000 00:00 0
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
7ffff7fb0000-7ffff7fb3000 rw-p 00000000 00:00 0
#0 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7de80f8 in _dl_protect_relro (l=0x7ffff7ff7658) at dl-reloc.c:321
#2 _dl_relocate_object (scope=<optimized out>, reloc_mode=<optimized out>, consider_profiling=<optimized out>, consider_profiling@entry=0) at dl-reloc.c:306
#3 0x00007ffff7ddfa33 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:2066
#4 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#5 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#6 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#7 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#8 0x0000000000000001 in ?? ()
#9 0x00007fffffffdb0e in ?? ()
#10 0x0000000000000000 in ?? ()
== Change protection to Read-Only after relocation processing (/bin/true)
_dl_protect_relro()
_dl_relocate_object()
Catchpoint 1 (call to syscall mprotect), 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mprotect), 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -1,5 +1,6 @@
555555554000-55555555a000 r-xp 00000000 08:03 198934 /usr/bin/true
-555555759000-55555575b000 rw-p 00005000 08:03 198934 /usr/bin/true
+555555759000-55555575a000 r--p 00005000 08:03 198934 /usr/bin/true
+55555575a000-55555575b000 rw-p 00006000 08:03 198934 /usr/bin/true
7ffff7a1b000-7ffff7bd2000 r-xp 00000000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7bd2000-7ffff7dd2000 ---p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
7ffff7dd2000-7ffff7dd6000 r--p 001b7000 08:03 526973 /usr/lib64/libc-2.22.so
#0 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7de80f8 in _dl_protect_relro (l=0x7ffff7ffe148) at dl-reloc.c:321
#2 _dl_relocate_object (scope=<optimized out>, reloc_mode=<optimized out>, consider_profiling=<optimized out>, consider_profiling@entry=0) at dl-reloc.c:306
#3 0x00007ffff7ddfa33 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:2066
#4 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#5 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#6 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#7 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#8 0x0000000000000001 in ?? ()
#9 0x00007fffffffdb0e in ?? ()
#10 0x0000000000000000 in ?? ()
Catchpoint 1 (call to syscall mprotect), 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall mprotect), 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -12,7 +12,8 @@
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
-7ffff7ffc000-7ffff7ffe000 rw-p 00020000 08:03 529029 /usr/lib64/ld-2.22.so
+7ffff7ffc000-7ffff7ffd000 r--p 00020000 08:03 529029 /usr/lib64/ld-2.22.so
+7ffff7ffd000-7ffff7ffe000 rw-p 00021000 08:03 529029 /usr/lib64/ld-2.22.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffdd000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
#0 0x00007ffff7df5527 in mprotect () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7de80f8 in _dl_protect_relro (l=0x7ffff7ffd998 <_rtld_local+2456>) at dl-reloc.c:321
#2 _dl_relocate_object (scope=<optimized out>, reloc_mode=reloc_mode@entry=0, consider_profiling=<optimized out>, consider_profiling@entry=0) at dl-reloc.c:306
#3 0x00007ffff7ddf8c1 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:2125
#4 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#5 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#6 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#7 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#8 0x0000000000000001 in ?? ()
#9 0x00007fffffffdb0e in ?? ()
#10 0x0000000000000000 in ?? ()
Catchpoint 1 (call to syscall munmap), 0x00007ffff7df5507 in munmap () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
Catchpoint 1 (returned from syscall munmap), 0x00007ffff7df5507 in munmap () at ../sysdeps/unix/syscall-template.S:84
84 T_PSEUDO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
---
+++
@@ -8,7 +8,6 @@
7ffff7dd8000-7ffff7ddc000 rw-p 00000000 00:00 0
7ffff7ddc000-7ffff7dfd000 r-xp 00000000 08:03 529029 /usr/lib64/ld-2.22.so
7ffff7fb0000-7ffff7fb3000 rw-p 00000000 00:00 0
-7ffff7fb3000-7ffff7ff7000 r--p 00000000 08:03 154196 /etc/ld.so.cache
7ffff7ff7000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
#0 0x00007ffff7df5507 in munmap () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007ffff7df31d8 in _dl_unload_cache () at dl-cache.c:318
#2 0x00007ffff7ddf90e in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:2167
#3 0x00007ffff7df3c00 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffd720, dl_main=dl_main@entry=0x7ffff7ddd990 <dl_main>) at ../elf/dl-sysdep.c:249
#4 0x00007ffff7de0bd1 in _dl_start_final (arg=0x7fffffffd720) at rtld.c:305
#5 _dl_start (arg=0x7fffffffd720) at rtld.c:411
#6 0x00007ffff7ddcc88 in _start () from /lib64/ld-linux-x86-64.so.2
#7 0x0000000000000001 in ?? ()
#8 0x00007fffffffdb0e in ?? ()
#9 0x0000000000000000 in ?? ()
main() called
[Inferior 1 (process 793) exited normally]
import gdb
import pprint
import difflib
class CatchSyscallState:
def __init__(self):
self.stop_count = 0
self.do_continue = False # execute 'continue' in main loop
self.maps_on_last_entry = None
def stop_handler(self, event):
if isinstance(event, gdb.BreakpointEvent):
return
# every syscall stops once on entry, once on return
if self.stop_count % 2 == 0:
self.syscall_entry_handler(event)
else:
self.syscall_exit_handler(event)
self.stop_count += 1
self.do_continue = True
def syscall_entry_handler(self, event):
pid = event.inferior_thread.ptid[0]
self.maps_on_last_entry = open('/proc/%d/maps' % (pid,)).read()
def syscall_exit_handler(self, event):
pid = event.inferior_thread.ptid[0]
t = open('/proc/%d/maps' % (pid,)).read()
prev = self.maps_on_last_entry.split('\n')
current = t.split('\n')
for l in difflib.unified_diff(prev, current, lineterm=''):
print(l)
gdb.execute('backtrace')
def exec_continue(self):
if not self.do_continue:
return
self.do_continue = False
gdb.execute('continue')
class MainBreakpoint(gdb.Breakpoint):
def stop(self):
gdb.write('\n\n\nmain() called\n\n\n')
return False
gdb.execute('set non-stop 1')
gdb.execute('file /bin/true')
gdb.execute('catch syscall mmap mprotect munmap')
# gdb.execute('commands 1\nsilent\nend\n')
s = CatchSyscallState()
gdb.events.stop.connect(s.stop_handler)
b = MainBreakpoint('main')
gdb.execute('run')
while s.do_continue:
s.exec_continue()
gdb.execute('quit')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment