0

Assuming I have a syscall to open.

man 2 open gives me info, that it requires 2 or 3 parameters

int open(const char *pathname, int flags);
int open(const char *pathname, int flags, mode_t mode);

So, my code runs and In my registers I have

$rdi = 0x00007fffffffdb40 → "/etc/init.d/",
$rsi = 0x0000000000000241,
$rdx = 0x00000000000001c9

How and which flags is it using during the call? How will the dir (or file) be opened?

  1. I am looking at the man page. The possible flags are mentioned, but not their bit/value/integer being set by |'ing the flags together in source code.
  2. I continue at the man page and see above the header files, which define the constants. In this case I'd need to #include <sys/types.h> <sys/stat.h> <fcntl.h>. However, in this files, I cannot find bits or integers, which sum or | up to the given flags ($rsi = 0x241, 577 in decimal, 1001000001 in binary) I cannot see any pattern.

Question: Do I oversee something? Do I need to look somewhere else? Where are those bits described?

  • 1
    You cant. Flags are defined with preprocessor #define. So compiler will replace that definition with integer. Only enumerations and structures can shows values. – Biswapriyo Sep 15 '18 at 21:19
4

The flags are constants drawn from here: https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h

They can change but very rarely.


Applying this we can see that

0x241 == O_WRONLY | O_CREAT | O_TRUNC

| improve this answer | |
  • For me it is not obvious to get from O_CREAT 00000100 | O_WRONLY 00000001 | O_TRUNC 00001000 to 0x241 ? What number-system do they use in this header file? Do you maybe have a reference on how to read those numbers? – Joel Sep 16 '18 at 6:55
  • 2
    literals prefixed with 0 are octals, so 0100 is 64 or 0x40. 01000 is 0x200, 1 is 1, so we're 0x40 + 0x200 + 1 = 0x241. – Abigail Sep 16 '18 at 10:17
  • thanks, makes sense now. For everyone else might read this, here is additional info: stackoverflow.com/questions/37326133/… – Joel Sep 16 '18 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.