Linux 进程内存模型 (2)

int x = 0x1234; // 全局初始化变量
char *s; // 全局未初始化变量

int test()
{
  static int i = 0x4567; // 静态局部变量
  return ++i;
}

int main(int argc, char** argv)
{
  int i = test() + x; // i: 局部变量
  s = "Hello, World!";

  char* p = (char*)malloc(10); // 动态分配地址

  return 0;
}

Symbol table '.symtab' contains 84 entries:
  Num: Value Size Type Bind Vis Ndx Name
  ... ...
  50: 0804a024 4 OBJECT LOCAL DEFAULT 24 i.2347
  57: 0804a030 4 OBJECT GLOBAL DEFAULT 25 s
  65: 0804a020 4 OBJECT GLOBAL DEFAULT 24 x

There are 38 section headers, starting at offset 0x1a10:

Section Headers:
  [Nr] Name Type Addr Off Size ES Flg Lk Inf Al
  ... ...
  [16] .rodata PROGBITS 08048618 000618 000030 00 A 0 0 4
  [24] .data PROGBITS 0804a018 001018 000010 00 WA 0 0 4
  [25] .bss NOBITS 0804a028 001028 00000c 00 WA 0 0 4
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings)
  I (info), L (link order), G (group), x (unknown)
  O (extra OS processing required) o (OS specific), p (processor specific)

int x = 0x1234;
char *s;

int test()
{
  ... ...
    static int i = 0x4567;
    return ++i;
  80484c7: mov eax,ds:0x804a024 ; 静态局部变量 i (对照上面符号表) 地址 0x804a024, .data 段
  80484cc: add eax,0x1
  80484cf: mov ds:0x804a024,eax
  80484d4: mov eax,ds:0x804a024
}
  ... ...

080484db <main>:

int main(int argc, char** argv)
{
  ... ...
    int i = test() + x;
  80484e4: call 80484c4 <test>
  80484e9: mov edx,DWORD PTR ds:0x804a020 ; 全局初始化变量 x 地址 0x804a020, .data 段
  80484ef: add eax,edx
  80484f1: mov DWORD PTR [esp+0x1c],eax
    s = "Hello, World!";
  80484f5: mov DWORD PTR ds:0x804a030,0x8048620 ; 全局未初始化变量 s 地址 0x804a030, .bss 段
    ; 字符串 "Hello, World!" 地址 0x8048620, .rodata 段
  ... ...

$2 = (int *) 0xbffff45c

$3 = 0x804b008 ""

Mapped address spaces:

  Start Addr End Addr Size Offset objfile
  0x804b000 0x806c000 0x21000 0 [heap]
  0xb7fef000 0xb7ff0000 0x1000 0
  0xb7ffe000 0xb8000000 0x2000 0
  0xbffeb000 0xc0000000 0x15000 0 [stack]