Retrieving args from open syscall

Question

The arguments being passed to the open syscall at runtime in a program I'm debugging seem to be as follows:

open("SOMESTRING", 0xa01, 0x1b6);

These were retrieved using lldb on OSX 12.1 Monterey by setting a breakpoint at the open syscall and then printing out the args like this:

(lldb) x/s $rdi
0x6000022b4150: "SOMESTRING"
(lldb) p/x $rsi
(unsigned long) $5 = 0x0000000000000a01
(lldb) p/x $rdx
(unsigned long) $6 = 0x00000000000001b6

Using 'man 2 open', I'm reading a description of the arguments and then I'm going to the appropriate header files to check the hex value of each flag to try to determine what the parameters mean. The problem is, nothing seems to be matching up.

From the open manpage:

 The flags specified for the oflag argument must include exactly one of the following file access modes:

   O_RDONLY        open for reading only
   O_WRONLY        open for writing only
   O_RDWR          open for reading and writing

 In addition any combination of the following values can be or'ed in oflag:

   O_NONBLOCK      do not block on open or for data to become available
   O_APPEND        append on each write
   O_CREAT         create file if it does not exist
   O_TRUNC         truncate size to 0
   O_EXCL          error if O_CREAT and the file exists
   O_SHLOCK        atomically obtain a shared lock
   O_EXLOCK        atomically obtain an exclusive lock
   O_DIRECTORY     restrict open to a directory
   O_NOFOLLOW      do not follow symlinks
   O_SYMLINK       allow open of symlinks
   O_EVTONLY       descriptor requested for event notifications only
   O_CLOEXEC       mark as close-on-exec
   O_NOFOLLOW_ANY  do not follow symlinks in the entire path.

Now when I head over to fcntl.h, and look at the value for these flags, none of them have the hex value 0xa00. I'm failing to see how OR'ing any of these flags together would ever reproduce a value of 0xa01. I'm having similar trouble with the mode arg. Could anyone help me understand what I'm doing wrong?

Answer 1

should be some thing like this compiles fine in godbolt.org

#include <fcntl.h>
int main (void) {
    open(
        "foo",
        //1      | 0x200   | 0x800 
        O_WRONLY | O_TRUNC | O_NONBLOCK,
        //0x100 | 0x80    | 0x40    | 0x20    | 0x4     | 0x2
        S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH 
        );
}

disassembled

main:
 push   rbp
 mov    rbp,rsp
 mov    edx,0x1b6
 mov    esi,0xa01
 mov    edi,0x402004
 mov    eax,0x0
 call   401030 <open@plt>
 mov    eax,0x0
 pop    rbp
 ret