On Sun, Oct 06, 2002 at 05:38:24PM -0700, Yue Luo wrote: > Is this "offset of mapping" the last argument to mmap()? Yes. > The following is 2 lines from the memory maps of process sshd: > 40143000-40166000 r-xp 00000000 08:03 327696 > /usr/lib/libglib-1.2.so.0.0.10 > 40166000-40167000 rw-p 00022000 08:03 327696 > /usr/lib/libglib-1.2.so.0.0.10 > I guess that the first line is for the code segment and the second > line is for the data. The offset is 0x22000. I used "objdump -h" to > show all the sections of the library. I found no section starting at > 0x22000. So what should be at the offset in the file? Or my newbie's > understanding is totally wrong? Remember that mmap() works in page-sizes only. So if you look for the nearest section (probably .data) then round it down to the next page boundary, you'll get your value. For example : 40000000-40015000 r-xp 00000000 03:07 392470 /lib/ld-2.2.so 40015000-40016000 rw-p 00014000 03:07 392470 /lib/ld-2.2.so 10 .rodata 00001da4 00012de0 00012de0 00012de0 2**5 CONTENTS, ALLOC, LOAD, READONLY, DATA 11 .data 000000b8 00015ba0 00015ba0 00014ba0 2**5 CONTENTS, ALLOC, LOAD, DATA The next lowest page boundary from the file offset of .data is 0x14000 (< 0x14ba0), and indeed, that's where we find it mapped from. regards john -- "I will eat a rubber tire to the music of The Flight of the Bumblebee" -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/