0

Assuming I have a syscall to open.

man 2 open gives me info, that it requires 2 or 3 parameters

int open(const char *pathname, int flags);
int open(const char *pathname, int flags, mode_t mode);

So, my code runs and In my registers I have

$rdi = 0x00007fffffffdb40 → "/etc/init.d/",
$rsi = 0x0000000000000241,
$rdx = 0x00000000000001c9

How and which flags is it using during the call? How will the dir (or file) be opened?

  1. I am looking at the man page. The possible flags are mentioned, but not their bit/value/integer being set by |'ing the flags together in source code.
  2. I continue at the man page and see above the header files, which define the constants. In this case I'd need to #include <sys/types.h> <sys/stat.h> <fcntl.h>. However, in this files, I cannot find bits or integers, which sum or | up to the given flags ($rsi = 0x241, 577 in decimal, 1001000001 in binary) I cannot see any pattern.

Question: Do I oversee something? Do I need to look somewhere else? Where are those bits described?

1
  • 1
    You cant. Flags are defined with preprocessor #define. So compiler will replace that definition with integer. Only enumerations and structures can shows values.
    – Biswapriyo
    Sep 15, 2018 at 21:19

1 Answer 1

4

The flags are constants drawn from here: https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h

They can change but very rarely.


Applying this we can see that

0x241 == O_WRONLY | O_CREAT | O_TRUNC

3
  • For me it is not obvious to get from O_CREAT 00000100 | O_WRONLY 00000001 | O_TRUNC 00001000 to 0x241 ? What number-system do they use in this header file? Do you maybe have a reference on how to read those numbers?
    – Joel
    Sep 16, 2018 at 6:55
  • 2
    literals prefixed with 0 are octals, so 0100 is 64 or 0x40. 01000 is 0x200, 1 is 1, so we're 0x40 + 0x200 + 1 = 0x241.
    – Abigail
    Sep 16, 2018 at 10:17
  • thanks, makes sense now. For everyone else might read this, here is additional info: stackoverflow.com/questions/37326133/…
    – Joel
    Sep 16, 2018 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.