osx - Why are the first 4 bytes of 64-bit addresses printed as 0x00000001? -
i'm looking @ disassembly of x86_64 code apple's otool
. here's sample of disassembly, outputted otool
:
0000000100055de4 movq $0x00000000,%rax
only last 4 bytes in offset, 00055de4
, represent file address of instruction. can open hex editor , navigate 0x55de4
, movq
instruction there.
however, noticed gdb works when include 8 bytes in address, including mysterious 1
. break *0x0000000100055de4
works expected, while break *0x00055de4
never triggers.
every 64-bit binary have analyzed otool
shows pattern. doesn't apply 32-bit addresses.
so, if 0x55de4
actual address, why otool
, gdb
use 0x0000000100055de4
?
__pagezero, first load command in 64 bit mach-o binary, specifies segment size of 0x100000000 in virtual memory.
$ otool -lv binary
command 0 cmd lc_segment_64 cmdsize 72 segname __pagezero vmaddr 0x0000000000000000 vmsize 0x0000000100000000
when break *0x00055de4
breakpoint ends in segment of zeros, explains why it's never hit. 0x0000000100055de4
address of instruction (found @ 0x55de4 in binary) when loaded virtual memory.
for 32 bit binaries __pagezero size 0x1000, explains why pattern not apply.
Comments
Post a Comment