Take the 2-minute tour ×

Details of my endeavour below, they are only partly relevant to my question:

In a map from /proc/pid/maps on an embedded linux (arm) with kernel version, the offset of the first line (the code segment of the executable itself) seems to be wrong.

I always see a line like:

00008000-00061000 r-xp 00000000 00:10 8073509 myprog

(the range is the address in the processes address space, the number after the permissions is supposed to be the offset into the file)

However, the actual offset seems to be 0x8000 - at least, interpretations using this assumption look much more credible. nm shows me that myprog doesn't have code before 0x8000, so that would make sense too.

Could someone give me a pointer to where I can find out more about this? I could not find anything.

What I am doing: I have written a tool to interpret logs generated by mtrace(), find possible memory leaks, and trace them back to the code allocating the data. For the latter step, I take an instruction pointer from the log, look it up in the run-time map from /proc/pid/maps to find the executable or library in question, and use their nm-map to find the actual function doing the allocation.

This works like a charm for everything but the executable itself.

share|improve this question

Your Answer



Browse other questions tagged or ask your own question.