"Turn" Linux PMAP command!

Original sticker: http://tonykorn97.itpub.net/post/6414/249221

Linux PMAP Command! =========================================================== Author: tonykorn97 (http://tonykorn97.itpub.net)
Comment posted: 2007.01.09 17:39
Category: Linux
Source: http://tonykorn97.itpub.net/post/6414/249221
---------------------------------------------------------------

Pmap

LDd

Stace

A few debugging commands to be familiar with!

The distribution of the address space of the specified process in the system is observed to show the size of the individual segments of a target file or a target file in a linked library file. The file obtains data from the/proc//maps.
Command format:
Pmap

Example:
[Email protected] security]# pmap-d 4993
4993:-bash
Address Kbytes Mode Offset Device Mapping
08047000 596 r-x--0000000000000000 003:00006 Bash Bash code snippet
080dc000 rwx--0000000000094000 003:00006 Bash bash data segment
080e3000 280 rwx--00000000080e3000 000:00000 [anon] bash heap
4d575000 r-x--0000000000000000 003:00006 ld-2.3.4.so shared library code snippet
4d58a000 4 r-x--0000000000015000 003:00006 ld-2.3.4.so shared library data segment
4d58b000 4 rwx--0000000000016000 003:00006 ld-2.3.4.so shared library heap
4d58e000 1164 r-x--0000000000000000 003:00006 libc-2.3.4.so
4d6b1000 4 r-x--0000000000123000 003:00006 libc-2.3.4.so
4d6b2000 rwx--0000000000124000 003:00006 libc-2.3.4.so
4d6b5000 8 rwx--000000004d6b5000 000:00000 [anon] anonymous physical memory,
4d6de000 8 r-x--0000000000000000 003:00006 libdl-2.3.4.so
4d6e0000 8 rwx--0000000000001000 003:00006 libdl-2.3.4.so
4d807000 r-x--0000000000000000 003:00006 libtermcap.so.2.0.8
4d80a000 4 rwx--0000000000002000 003:00006 libtermcap.so.2.0.8
b7bc2000 176 r-x--0000000000000000 003:00006 gb18030.so
b7bee000 8 rwx--000000000002b000 003:00006 gb18030.so
b7bf0000 r-xs-0000000000000000 003:00006 Gconv-modules.cache
b7bf6000 1060 r-x--0000000002197000 003:00006 locale-archive
b7cff000 2048 r-x--0000000000000000 003:00006 locale-archive
b7eff000 r-x--0000000000000000 003:00006 libnss_files-2.3.4.so
b7f08000 8 rwx--0000000000008000 003:00006 libnss_files-2.3.4.so
b7f0a000 8 rwx--00000000b7f0a000 000:00000 [anon]
b7f20000 8 rwx--00000000b7f20000 000:00000 [anon]
bff0d000-RW---00000000bff0d000 000:00000 [stack]
ffffe000 4-----0000000000000000 000:00000 [anon]
mapped:5680k writeable/private:460k shared:24k


Each column has the following meanings:
Parameter interpretation
The address space occupied by the address:00378000-0038d000 process
Kbytes the size of the virtual segment
RSS device number (main device: Secondary device)
The node number of the Anon device, 0 indicates that no node corresponds to memory
Locked whether to allow swapped
Mode permissions: R=read, W=write, X=execute, s=shared, p=private (copy on Write)
Mapping:bash the corresponding image file name

[Email protected] security]# pmap-x 4993
4993:-bash
Address Kbytes RSS Anon Locked Mode Mapping
08047000 596---r-x--bash
080dc000---rwx--bash
080e3000 280---rwx--[anon]
4d575000---r-x--ld-2.3.4.so
4d58a000 4---r-x--ld-2.3.4.so
4d58b000 4---rwx--ld-2.3.4.so
4d58e000 1164---r-x--libc-2.3.4.so
4d6b1000 4---r-x--libc-2.3.4.so
4d6b2000---rwx--libc-2.3.4.so
4d6b5000 8---rwx--[anon]
4d6de000 8---r-x--libdl-2.3.4.so
4d6e0000 8---rwx--libdl-2.3.4.so
4d807000---r-x--libtermcap.so.2.0.8
4d80a000 4---rwx--libtermcap.so.2.0.8
B7BC2000 176---r-x--gb18030.so
b7bee000 8---rwx--gb18030.so
b7bf0000---R-xs-gconv-modules.cache
b7bf6000 1060---r-x--locale-archive
b7cff000 2048---r-x--locale-archive
b7eff000---r-x--libnss_files-2.3.4.so
b7f08000 8---rwx--libnss_files-2.3.4.so
b7f0a000 8---rwx--[anon]
b7f20000 8---rwx--[anon]
bff0d000--RW---[Stack]
ffffe000 4--------[anon]
-------- ------- ------- ------- -------
Total KB 5680---
[Email protected] security]#

Name:
       pmap-report Memory Map of a process (to view a process's image information)
Usage
        pmap [-X |-d] [-Q] PIDs ...
       pmap-v
option meaning
      -x   extended       Show the extended format. Show extended format
      -d   device          Show the device format.   format
      -q   quiet & nbsp;        does not display some header/footer lines. Do not display kinsoku lines
      -v   show version   displays version of program. Show version

Extended format and Device format fields:
        address:  start address of map  image start addresses
        kbytes:  size of map in kilobytes  image sizes
         rss:  resident set size in kilobytes  resident set
         dirty:  Dirty pages (both shared and private) in kilobytes  dirty page size
         mode:  permissions on map image permissions: R=read, W=write, X=execute, s=shared, p=private (copy on Write) &NB SP;&NBSP
        mapping:  file backing the map, or ' [anon] ' for allocated memory, or ' [stack] ' for the program stack.  image support file, [anon] for the allocated RAM [stack] for the procedure stack
     & nbsp;  offset:  offset into the file  file offset
        device:  Device name (major:minor)   unit name

Example:

To view the device format for process 1

[Email protected] ~]# pmap-d11: Init [5] Address kbytes Mode Offset Device Mapping00934000       ther-x--0000000000000000 008:00005 LD-2.3.4. so0094a0004R----0000000000015000 008:00005 LD-2.3.4. so0094b0004RW---0000000000016000 008:00005 LD-2.3.4. so0094e0001188r-x--0000000000000000 008:00005libc-2.3.4. so00a770008R----0000000000129000 008:00005libc-2.3.4. so00a790008RW---000000000012b000008:00005libc-2.3.4. so00a7b0008RW---0000000000a7b000 the:00000[Anon]00a85000 ther-x--0000000000000000 008:00005Libsepol.so.100a920004RW---000000000000c000008:00005Libsepol.so.100a93000 +RW---0000000000a93000 the:00000[Anon]00d9d000 ther-x--0000000000000000 008:00005Libselinux.so.100daa0004RW---000000000000d000008:00005Libselinux.so.108048000       -r-x--0000000000000000 008:00005init0804f0004RW---0000000000007000 008:00005init084e1000 theRW---00000000084e1000 the:00000[Anon]b7f5d0008RW---00000000b7f5d000 the:00000[Anon]bffee000 theRW---00000000bffee000 the:00000[Stack]ffffe0004-----0000000000000000  the:00000[Anon]mapped:1700k writeable/private:276k Shared:0k[[email protected]~]#

The value of the last row
Mapped represents the size of the virtual address space for the process map, which is the amount of virtual memory that the process has pre-allocated, which is the PS-out vsz
Writeable/private represents the size of the private address space that the process consumes, that is, the amount of memory that the process actually uses
Shared represents the amount of memory shared by the process and other processes

View the device format for process 1 without showing the Kinsoku line

[Email protected] ~]# pmap-d-Q11: Init [5]                    00934000       ther-x--0000000000000000 008:00005 LD-2.3.4. so0094a0004R----0000000000015000 008:00005 LD-2.3.4. so0094b0004RW---0000000000016000 008:00005 LD-2.3.4. so0094e0001188r-x--0000000000000000 008:00005libc-2.3.4. so00a770008R----0000000000129000 008:00005libc-2.3.4. so00a790008RW---000000000012b000008:00005libc-2.3.4. so00a7b0008RW---0000000000a7b000 the:00000[Anon]00a85000 ther-x--0000000000000000 008:00005Libsepol.so.100a920004RW---000000000000c000008:00005Libsepol.so.100a93000 +RW---0000000000a93000 the:00000[Anon]00d9d000 ther-x--0000000000000000 008:00005Libselinux.so.100daa0004RW---000000000000d000008:00005Libselinux.so.108048000       -r-x--0000000000000000 008:00005init0804f0004RW---0000000000007000 008:00005init084e1000 theRW---00000000084e1000 the:00000[Anon]b7f5d0008RW---00000000b7f5d000 the:00000[Anon]bffee000 theRW---00000000bffee000 the:00000[Stack]ffffe0004-----0000000000000000  the:00000[anon][[email protected]~]#

View the extended format for process 1

[Email protected] ~]# pmap-x11: Init [5] Address kbytes RSS Anon Locked Mode Mapping00934000       the---r-x--LD-2.3.4. so0094a0004---R----LD-2.3.4. so0094b0004---RW---LD-2.3.4. so0094e0001188---r-x--libc-2.3.4. so00a770008---R----libc-2.3.4. so00a790008---RW---libc-2.3.4. so00a7b0008---RW---[Anon]00a85000 the---r-x--libsepol.so.100a920004--RW---libsepol.so.100a93000 +---RW---[Anon]00d9d000 the---r-x--libselinux.so.100daa0004--RW---libselinux.so.108048000       ----r-x--init0804f0004---RW---init084e1000 the---RW---[Anon]b7f5d0008---RW---[Anon]bffee000 the---RW---[Stack]ffffe0004-       -       - -----[Anon]-------- ------- ------- ------- -------Total KB1700-       -       -[[Email protected]~]#

Loop shows the last 1 lines of the device format for process 3066, in intervals of 2 seconds,

[Email protected] ~]# while true; DoPmap-d3066|Tail-1;Sleep 2; Donemapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0kmapped:5412k writeable/private:2028k shared:0k