1 /**
 2  * showmemory.c -- print the position of different types of data in a program in the memory
 3  */
 4 
 5 #include <sys/types.h>
 6 #include <sys/ipc.h>
 7 #include <sys/shm.h>
 8 #include <stdio.h>
 9 #include <stdlib.h>
10 
11 #define ARRAY_SIZE 4000
12 #define MALLOC_SIZE 100000
13 #define SHM_SIZE 100000
14 #define SHM_MODE (SHM_R | SHM_W)        /* user read/write */
15 
16                                         /* declare the address relative variables */
17 extern char _start, __data_start, __bss_start, etext, edata, end;
18 extern char **environ;
19 
20 char array[ARRAY_SIZE];         /* uninitialized data = bss */
21 
22 int main(int argc, char *argv[])
23 {
24     int shmid;
25     char *ptr, *shmptr;
26 
27     printf("===== memory map =====\n");
28     printf(".text:\t0x%x->0x%x (_start, code text)\n", &_start, &etext);
29     printf(".data:\t0x%x->0x%x (__data_start, initilized data)\n", &__data_start, &edata);
30     printf(".bss: \t0x%x->0x%x (__bss_start, uninitilized data)\n", &__bss_start, &end);
31 
32     /* shmid is a local variable, which is stored in the stack, hence, you
33      * can get the address of the stack via it*/
34 
35     if ( (ptr = malloc(MALLOC_SIZE)) == NULL) {
36         printf("malloc error!\n");
37         exit(-1);
38     }
39 
40     printf("heap: \t0x%x->0x%x (address of the malloc space)\n", ptr, ptr+MALLOC_SIZE);
41 
42     if ( (shmid = shmget(IPC_PRIVATE, SHM_SIZE, SHM_MODE)) < 0) {
43         printf("shmget error!\n");
44         exit(-1);
45     }
46 
47     if ( (shmptr = shmat(shmid, 0, 0)) == (void *) -1) {
48         printf("shmat error!\n");
49         exit(-1);
50     }
51     printf("shm  :\t0x%x->0x%x (address of shared memory)\n", shmptr, shmptr+SHM_SIZE);
52 
53     if (shmctl(shmid, IPC_RMID, 0) < 0) {
54         printf("shmctl error!\n");
55         exit(-1);
56     }
57 
58     printf("stack:\t <--0x%x--> (address of local variables)\n", &shmid);   
59     printf("arg:  \t0x%x (address of arguments)\n", argv);
60     printf("env:  \t0x%x (address of environment variables)\n", environ);
61 
62     exit(0);
63 }

 1 # hello.s
 2 #
 3 # $ as --32 -o hello.o hello.s
 4 # $ ld -melf_i386 --oformat=binary -o hello hello.o
 5 # $ export PATH=./:$PATH
 6 # $ hello 0 0 0
 7 # hello
 8 #
 9 
10     .file "hello.s"
11     .global _start, _load
12     .equ   LOAD_ADDR, 0x00010000   # Page aligned load addr, here 64k
13     .equ   E_ENTRY, LOAD_ADDR + (_start - _load)
14     .equ   P_MEM_SZ, E_ENTRY
15     .equ   P_FILE_SZ, P_MEM_SZ
16 
17 _load:
18     .byte  0x7F
19     .ascii "ELF"              # e_ident, Magic Number
20     .long  1                                      # p_type, loadable seg
21     .long  0                                      # p_offset
22     .long  LOAD_ADDR                              # p_vaddr
23     .word  2                  # e_type, exec  # p_paddr
24     .word  3                  # e_machine, Intel 386 target
25     .long  P_FILE_SZ          # e_version     # p_filesz
26     .long  E_ENTRY            # e_entry       # p_memsz
27     .long  4                  # e_phoff       # p_flags, read(exec)
28     .text
29 _start:
30     popl   %eax    # argc     # e_shoff       # p_align
31                    # 4 args, eax = 4, sys_write(fd, addr, len) : ebx, ecx, edx
32                    # set 2nd eax = random addr to trigger bad syscall for exit
33     popl   %ecx    # argv[0]
34     mov    $5, %dl # str len  # e_flags
35     int    $0x80
36     loop   _start  # loop to popup a random addr as a bad syscall number
37     .word  0x34               # e_ehsize = 52
38     .word  0x20               # e_phentsize = 32
39     .byte  1                  # e_phnum = 1, remove trailing 7 bytes with 0 value
40                               # e_shentsize
41                               # e_shnum
42                               # e_shstrndx