I wrote main.c in Linux:

int main()
  while (1){}

When I compile and start it, I can pmap it:

# pmap 28578
28578:   ./a.out
0000000000400000      4K r-x--  /root/a.out
0000000000600000      4K r----  /root/a.out
0000000000601000      4K rw---  /root/a.out
00007f87c16c2000   1524K r-x--  /lib/libc-2.11.1.so
00007f87c183f000   2044K -----  /lib/libc-2.11.1.so
00007f87c1a3e000     16K r----  /lib/libc-2.11.1.so
00007f87c1a42000      4K rw---  /lib/libc-2.11.1.so
00007f87c1a43000     20K rw---    [ anon ]
00007f87c1a48000    128K r-x--  /lib/ld-2.11.1.so
00007f87c1c55000     12K rw---    [ anon ]
00007f87c1c65000      8K rw---    [ anon ]
00007f87c1c67000      4K r----  /lib/ld-2.11.1.so
00007f87c1c68000      4K rw---  /lib/ld-2.11.1.so
00007f87c1c69000      4K rw---    [ anon ]
00007fff19b82000     84K rw---    [ stack ]
00007fff19bfe000      8K r-x--    [ anon ]
ffffffffff600000      4K r-x--    [ anon ]
 total             3876K

total (3876) divided by K equals the VIRT column in the output of top. Now where is the text segment? At 400000, 600000 and 601000, right? Where can I read an explanation what is where? man pmap did not help.

  • text segments are actually read only, so it is at 0000000000600000 . – Danila Ladner Dec 17 '13 at 18:04
  • Thanks! Shouldn't the text segment be executable as well? – Thorsten Staerk Dec 17 '13 at 18:44
  • 1
    Yes, you are right. r and r-x. 0000000000400000 as well. – Danila Ladner Dec 17 '13 at 19:23

The text segment is the mapping at 0x400000 - it's marked 'r-x' for readable and executable. The mapping at 0x600000 is read-only, so that's almost certainly the ".rodata" section of the executable file. GCC puts C string literals into a read-only section. The mapping at 0x601000 is 'rw-', so that's probably the famed heap. You could have your executable malloc() 1024 bytes and print out the address to see for sure.

You might get a little bit more information by finding the PID of your process, and doing: cat /proc/$PID/maps - on my Arch laptop, that gives some extra info. It's running a 3.12 kernel, so it also has /proc/$PID/numa_maps, and catting that might give a small insight, too.

Other things to run on the executable file: nm and objdump -x. The former can give you an idea of where various things lie in the memory map, so you can see what's in the 0x4000000 section vs the other sections. objdump -x shows you ELF file headers among lots of other things, so you can see all the sections, complete with section names and whether they're mapped in a run time or not.

As far as finding a written explanation of "what is where", you'll have to do things like google for "ELF FILE memory layout". Be aware that the ELF file format can support more exotic memory layouts than commonly get used. GCC and Gnu ld and glibc all make simplifying assumptions about how an executable file gets laid out and then mapped into memory at run time. Lots of web pages exist that purport to document this, but only apply to older versions of Linux, older versions of GCC or glibc, or only apply to x86 executables. If you don't have it, get the readelf command. If you can write C programs, create your own version of objdump -x or readelf to become familiar with how executable files work, and what's in them.

| improve this answer | |
  • 2
    Great answer. Now, where is the program's heap? And what does this [ anon ] mean? What do I have to google to find this out? – Thorsten Staerk Dec 17 '13 at 21:08
  • 1
    You know what? I was wrong about the 0x601000 address mapping - that's the heap, probably. You'll have to use readelf or objdump to figure it out, and whatever the executable you've made. My Arch linux box uses /usr/lib/libc-2.18.so, so it's quite different than your box. – Bruce Ediger Dec 18 '13 at 3:22
  • 2
    0x601000 is the data segment. It contains .data, .bss and can be extended via brk(). [anon] indicates non-file backed memory (so backed by swap), obtained via mmap(). dlmalloc uses brk() for allocations smaller than ~64Kb IIRC, and mmap() for larger allocations. The heap is everything allocated by malloc, both the extended part of the data segment, and the mmap()-based allocations. – ninjalj Dec 18 '13 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.