I am reversing a binary using Ghidra. In the disassembled output, I have the following lines in the main function:

(code *)mmap((void *)0x0,0x55,7,0x22,-1,0)

I am quite confused here since the file descriptor appears to be -1 and I remember reading that file descriptors should be non-negative.

Can someone please tell me what I am missing here?



Relevant section pertaining to the flags argument (emphasis added):

MAP_ANONYMOUS: The mapping is not backed by any file; its contents are initialized to zero. The fd argument is ignored; however, some implementations require fd to be -1 if MAP_ANONYMOUS (or MAP_ANON) is specified, and portable applications should ensure this. The offset argument should be zero. The use of MAP_ANONYMOUS in conjunction with MAP_SHARED is supported on Linux only since kernel 2.4.

While this seems like a likely explanation, it isn't a 100% guarantee on its own. You could find further proof by looking at the headers for the system you're REing to confirm that MAP_ANONYMOUS is indeed being used as part of the flags.

  • Yes, what you are saying is true. It took me a while and help from another person to realize this. Thank you :) – mechatron Dec 8 '20 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.