In addition to what Avadh said, you can match the address to the contents of /proc/kallsyms to get the actual function call too.
Tyler > On Fri Feb 06 2015 at 1:18:55 PM alireza nazari <[email protected]> > wrote: > >> *I sent a post similar to this few month ago but did not get any answer. >> Any thoughts on this is appreciated. >> >> Hello, >> >> I am running an application on MARSSx86 and I see lots of addresses look >> like "ffffffff810ee075" which I don't think falls into the region that >> my >> program is mapped(my program addresses are recognizable as they look >> like >> "000000000040d865"). Does anybody know what these address are and how I >> can >> find out what exactly they do if they are exception handlers or system >> calls?! >> > Its a kernel address space so either system call or interrupt handler is > executing. > > >> general question is how I can recognize address mapping of system calls, >> exception handlers, dynamic libs etc.?! >> >> You can use pmap on running process to view memory map of the process. > > - Avadh > >> Thank you >> Alireza >> _______________________________________________ >> http://www.marss86.org >> Marss86-Devel mailing list >> [email protected] >> https://www.cs.binghamton.edu/mailman/listinfo/marss86-devel >> > _______________________________________________ > http://www.marss86.org > Marss86-Devel mailing list > [email protected] > https://www.cs.binghamton.edu/mailman/listinfo/marss86-devel > _______________________________________________ http://www.marss86.org Marss86-Devel mailing list [email protected] https://www.cs.binghamton.edu/mailman/listinfo/marss86-devel
