本文是操作系統課存儲器管理學習完後老師的一些補充資料。較詳細的介紹了Linux下進程地址空間的分配,並做了驗證性實驗。需要原始文檔的,請點擊下載。
驗證性實驗分爲“一個進程地址空間的分析”和“多個進程地址空間的分析”(本次分析爲了簡便只針對兩個進程)。前者主要是爲了驗證一個進程中code segment,data segment,bss segment,及heap和memory mapping 的地址是否如資料中所述落在了內存中相應的位置。後者主要是對兩個進程做的對照分析。具體的說明我將以註釋的形式添加在相應位置。
下面是有關進程地址空間分配的資料:
下面是相關的驗證性論文:
Linux進程地址空間的分析
一、單一進程地址空間分析
pth-memory是專門設計來顯示進程中不同區域的邏輯地址的實驗程序,主要是要了解多線程情況下,不同線程的運行堆棧地址如何規劃,順便也把幾個基本進程區域地址顯示出來。
1、pth-memory.c
pth-memory.c的源代碼如下,其中關鍵語句均已標紅。
/* pth-memory.c : memmory layout in multiple thread program
*To compile: gcc -o pth-memory pth-memory.c -lpthread
*/
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
pthread_t thread[2];
int number=1;
void *thread_local_ptr1, *thread_local_ptr2, *thread_local_ptr3;//記錄線程1,2,3的起始位置
void *code_ptr, *bss_ptr, *data_ptr;//記錄代碼段,數據段,bss段的起始位置(bss segment 用來存放程序中未初始化的一段內存區域)
void *heap_ptr, *mmap_ptr;//記錄堆起始地址,內存映射地址(mmap memory mapping 內存映射)
void *thread1()
{
int test1;
test1=number;
thread_local_ptr1 = (void *) &test1;//test1 的地址可以代表thread1的地址
pthread_exit(NULL);
}
void *thread2()
{
int test2;
test2=number;
thread_local_ptr2 = (void *) &test2;
pthread_exit(NULL);
}
void thread_create(void)
{
memset(&thread, 0, sizeof(thread));// memset:作用是在一段內存塊中填充某個給定的值,它是對較大的結構體或數組進行清零操作的一種最快方法
if(pthread_create(&thread[0], NULL, thread1, NULL) != 0)
printf("Fail to create thread 1.\n");
else
printf("Thread 1 established.\n");
if(pthread_create(&thread[1], NULL, thread2, NULL) != 0)
printf("Fail to create thread 2.\n");
else
printf("Thread 2 established.\n");
}
void thread_wait(void)
{
if(thread[0] !=0)
pthread_join(thread[0],NULL);
if(thread[1] !=0)
pthread_join(thread[1],NULL);
}
int main()
{
int x;
<span style="color:#ff0000;">thread_local_ptr3 = (void *)&x;//獲取主線程執行開始處地址
code_ptr = (void *)&thread_wait;//獲取代碼段地址
data_ptr = (void *)&number;//獲取數據段地址
bss_ptr = (void *)&code_ptr;//獲取未初始化內存地址</span>
heap_ptr = malloc(4);
mmap_ptr = mmap(NULL, 4, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
printf("Try to demonstrate how the memory layout looks like in a multi-thread process.\n");
thread_create();
thread_wait();
<span style="color:#ff0000;">printf("\ncode: %x\n",(int)code_ptr);
printf("data: %x\n",(int)data_ptr);
printf("bss: %x\n",(int)bss_ptr);
printf("heap: %x\n",(int)heap_ptr);
printf("mmap: %x\n",(int)mmap_ptr);
printf("thread1 stack: %x\n",(int)thread_local_ptr1);
printf("thread2 stack: %x\n",(int)thread_local_ptr2);
printf("main thread stack: %x\n",(int)thread_local_ptr3);</span>
scanf("%d", &x);
free(heap_ptr);
munmap(mmap_ptr,4);
return 0;
}
2、pth-memory.output
pth-memory執行輸出結果中地址相關部分如下,需要說明的是,輸出內容與上面程序不是完全對應,因爲這是早期版本的執行結果;後面要和其他進程比較內存信息,所以用的是截取/proc下相關文件時的運行結果。
code: 80486a2 ①
data: 804a02c ②
bss: 804a03c ③
thread1 stack: b7e893c4 ④
thread2 stack: b76883c4 ⑤
main thread stack: bfdda310 ⑥
3、pth-memory.maps
pth-memory運行時截取的maps文件如下,與輸出結果中各項對應的進程地址空間區域均已標紅。
二、不同進程地址空間分析
1、用到的文件
對進程地址空間的分析主要用兩個數據文件:.maps文件和.pages文件,後者是從.pagemap文件用hexdump導出的文件,便於閱讀分析,已經把大批相同內容用“*”省略,並給出了文件中的偏移地址。
(1)分析方法
從.maps文件找到需要分析區域的起止地址,根據地址除以0x200可折算出在頁表導出文件中的偏移量(0x200原因:頁長0x1000/頁表項長8),對比相應內容可以知道是否映射到相同的物理地址。
(2)分析內容
相同程序對應的不同進程,其代碼區是否相同;數據區是否獨立;動態鏈接函數庫是否是同一個副本。不同程序對應的不同進程,動態鏈接函數庫是否是同一個副本。
2、相同程序對應的不同進程
註釋:此處主要是爲了說明兩個相同程序中,內存映射(邏輯地址、權限、文件路徑),數據段,代碼段,動態鏈接庫在系統內存中邏輯上都是相同的(進程間的物理地址肯定不同了—引用內核中相同的動態鏈接庫除外)。
選用的程序是bash,兩個bash的進程相關文件名分別是bash.0.*和bash.1.*。 bash.0.maps和bash.1.maps文件對比情況見下表,爲便於對比,對文件內容做了一些簡化調整。需要對比的部分均標紅。
(1)代碼區情況對比
對比bash.0.maps與bash.1.maps中的代碼區,邏輯地址範圍均是08048000-080ec000,對應pages文件中偏移量爲00040240-00040760,pages文件對比如下表所示,相關部分標紅。
bash.0.pages |
bash.1.pages |
00000000 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 06 * 00040240 53 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 00040250 51 ff 01 00 00 00 00 86 50 ff 01 00 00 00 00 86 00040260 3e ff 01 00 00 00 00 86 3d ff 01 00 00 00 00 86 00040270 3c ff 01 00 00 00 00 86 3b ff 01 00 00 00 00 86 00040280 3a ff 01 00 00 00 00 86 04 ff 01 00 00 00 00 86 00040290 00 00 00 00 00 00 00 00 23 ff 01 00 00 00 00 86 000402a0 1c ff 01 00 00 00 00 86 1d ff 01 00 00 00 00 86 000402b0 1b ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 000402c0 1e ff 01 00 00 00 00 86 1f ff 01 00 00 00 00 86 000402d0 08 ff 01 00 00 00 00 86 54 ff 01 00 00 00 00 86 000402e0 72 ff 01 00 00 00 00 86 71 ff 01 00 00 00 00 86 000402f0 70 ff 01 00 00 00 00 86 6f ff 01 00 00 00 00 86 00040300 6e ff 01 00 00 00 00 86 6d ff 01 00 00 00 00 86 00040310 6c ff 01 00 00 00 00 86 6b ff 01 00 00 00 00 86 00040320 6a ff 01 00 00 00 00 86 69 ff 01 00 00 00 00 86 00040330 68 ff 01 00 00 00 00 86 67 ff 01 00 00 00 00 86 00040340 3f fe 01 00 00 00 00 86 3e fe 01 00 00 00 00 86 00040350 3d fe 01 00 00 00 00 86 3c fe 01 00 00 00 00 86 00040360 3b fe 01 00 00 00 00 86 3a fe 01 00 00 00 00 86 00040370 39 fe 01 00 00 00 00 86 38 fe 01 00 00 00 00 86 00040380 37 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 00040390 35 fe 01 00 00 00 00 86 34 fe 01 00 00 00 00 86 000403a0 33 fe 01 00 00 00 00 86 50 fe 01 00 00 00 00 86 000403b0 6e fe 01 00 00 00 00 86 6d fe 01 00 00 00 00 86 000403c0 6c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 000403d0 00 00 00 00 00 00 00 00 24 15 00 00 00 00 00 86 000403e0 23 15 00 00 00 00 00 86 22 15 00 00 00 00 00 86 000403f0 21 15 00 00 00 00 00 86 20 15 00 00 00 00 00 86 00040400 1f 15 00 00 00 00 00 86 1e 15 00 00 00 00 00 86 00040410 1d 15 00 00 00 00 00 86 1c 15 00 00 00 00 00 86 00040420 1b 15 00 00 00 00 00 86 1a 15 00 00 00 00 00 86 00040430 19 15 00 00 00 00 00 86 18 15 00 00 00 00 00 86 00040440 17 15 00 00 00 00 00 86 16 15 00 00 00 00 00 86 00040450 15 15 00 00 00 00 00 86 a7 15 00 00 00 00 00 86 00040460 a6 15 00 00 00 00 00 86 6a fe 01 00 00 00 00 86 00040470 69 fe 01 00 00 00 00 86 68 fe 01 00 00 00 00 86 00040480 67 fe 01 00 00 00 00 86 66 fe 01 00 00 00 00 86 00040490 65 fe 01 00 00 00 00 86 64 fe 01 00 00 00 00 86 000404a0 63 fe 01 00 00 00 00 86 62 fe 01 00 00 00 00 86 000404b0 61 fe 01 00 00 00 00 86 60 fe 01 00 00 00 00 86 000404c0 5f fe 01 00 00 00 00 86 5e fe 01 00 00 00 00 86 000404d0 00 00 00 00 00 00 00 00 5c fe 01 00 00 00 00 86 000404e0 5b fe 01 00 00 00 00 86 5a fe 01 00 00 00 00 86 000404f0 59 fe 01 00 00 00 00 86 58 fe 01 00 00 00 00 86 00040500 00 00 00 00 00 00 00 00 56 fe 01 00 00 00 00 86 00040510 55 fe 01 00 00 00 00 86 54 fe 01 00 00 00 00 86 00040520 53 fe 01 00 00 00 00 86 52 fe 01 00 00 00 00 86 00040530 6f fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 00040540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00040550 00 00 00 00 00 00 00 00 09 15 00 00 00 00 00 86 00040560 08 15 00 00 00 00 00 86 07 15 00 00 00 00 00 86 00040570 06 15 00 00 00 00 00 86 05 15 00 00 00 00 00 86 00040580 04 15 00 00 00 00 00 86 03 15 00 00 00 00 00 86 00040590 02 15 00 00 00 00 00 86 01 15 00 00 00 00 00 86 000405a0 00 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00 000405b0 7e fe 01 00 00 00 00 86 7d fe 01 00 00 00 00 86 000405c0 7c fe 01 00 00 00 00 86 7b fe 01 00 00 00 00 86 000405d0 00 00 00 00 00 00 00 00 79 fe 01 00 00 00 00 86 000405e0 78 fe 01 00 00 00 00 86 77 fe 01 00 00 00 00 86 000405f0 76 fe 01 00 00 00 00 86 75 fe 01 00 00 00 00 86 00040600 00 00 00 00 00 00 00 00 73 fe 01 00 00 00 00 86 00040610 72 fe 01 00 00 00 00 86 1a 41 01 00 00 00 00 86 00040620 19 41 01 00 00 00 00 86 18 41 01 00 00 00 00 86 00040630 2c fe 01 00 00 00 00 86 2b fe 01 00 00 00 00 86 00040640 2a fe 01 00 00 00 00 86 29 fe 01 00 00 00 00 86 00040650 28 fe 01 00 00 00 00 86 27 fe 01 00 00 00 00 86 00040660 26 fe 01 00 00 00 00 86 25 fe 01 00 00 00 00 86 00040670 24 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 00040680 4f fe 01 00 00 00 00 86 4e fe 01 00 00 00 00 86 00040690 4d fe 01 00 00 00 00 86 4c fe 01 00 00 00 00 86 000406a0 4b fe 01 00 00 00 00 86 4a fe 01 00 00 00 00 86 000406b0 49 fe 01 00 00 00 00 86 48 fe 01 00 00 00 00 86 000406c0 47 fe 01 00 00 00 00 86 46 fe 01 00 00 00 00 86 000406d0 45 fe 01 00 00 00 00 86 44 fe 01 00 00 00 00 86 000406e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 00040730 49 ff 01 00 00 00 00 86 48 ff 01 00 00 00 00 86 00040740 47 ff 01 00 00 00 00 86 46 ff 01 00 00 00 00 86 00040750 45 ff 01 00 00 00 00 86 44 ff 01 00 00 00 00 86 00040760 a2 45 01 00 00 00 00 86 b1 45 01 00 00 00 00 86 |
00000000 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 06 * 00040240 53 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 00040250 51 ff 01 00 00 00 00 86 50 ff 01 00 00 00 00 86 00040260 3e ff 01 00 00 00 00 86 3d ff 01 00 00 00 00 86 00040270 3c ff 01 00 00 00 00 86 3b ff 01 00 00 00 00 86 00040280 3a ff 01 00 00 00 00 86 04 ff 01 00 00 00 00 86 00040290 00 00 00 00 00 00 00 00 23 ff 01 00 00 00 00 86 000402a0 1c ff 01 00 00 00 00 86 1d ff 01 00 00 00 00 86 000402b0 1b ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 000402c0 1e ff 01 00 00 00 00 86 1f ff 01 00 00 00 00 86 000402d0 08 ff 01 00 00 00 00 86 54 ff 01 00 00 00 00 86 000402e0 72 ff 01 00 00 00 00 86 71 ff 01 00 00 00 00 86 000402f0 70 ff 01 00 00 00 00 86 6f ff 01 00 00 00 00 86 00040300 6e ff 01 00 00 00 00 86 6d ff 01 00 00 00 00 86 00040310 6c ff 01 00 00 00 00 86 6b ff 01 00 00 00 00 86 00040320 6a ff 01 00 00 00 00 86 69 ff 01 00 00 00 00 86 00040330 68 ff 01 00 00 00 00 86 67 ff 01 00 00 00 00 86 00040340 3f fe 01 00 00 00 00 86 3e fe 01 00 00 00 00 86 00040350 3d fe 01 00 00 00 00 86 3c fe 01 00 00 00 00 86 00040360 3b fe 01 00 00 00 00 86 3a fe 01 00 00 00 00 86 00040370 39 fe 01 00 00 00 00 86 38 fe 01 00 00 00 00 86 00040380 37 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 00040390 35 fe 01 00 00 00 00 86 34 fe 01 00 00 00 00 86 000403a0 33 fe 01 00 00 00 00 86 50 fe 01 00 00 00 00 86 000403b0 6e fe 01 00 00 00 00 86 6d fe 01 00 00 00 00 86 000403c0 6c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 000403d0 00 00 00 00 00 00 00 00 24 15 00 00 00 00 00 86 000403e0 23 15 00 00 00 00 00 86 22 15 00 00 00 00 00 86 000403f0 21 15 00 00 00 00 00 86 20 15 00 00 00 00 00 86 00040400 1f 15 00 00 00 00 00 86 1e 15 00 00 00 00 00 86 00040410 1d 15 00 00 00 00 00 86 1c 15 00 00 00 00 00 86 00040420 1b 15 00 00 00 00 00 86 1a 15 00 00 00 00 00 86 00040430 19 15 00 00 00 00 00 86 18 15 00 00 00 00 00 86 00040440 17 15 00 00 00 00 00 86 16 15 00 00 00 00 00 86 00040450 15 15 00 00 00 00 00 86 a7 15 00 00 00 00 00 86 00040460 a6 15 00 00 00 00 00 86 6a fe 01 00 00 00 00 86 00040470 69 fe 01 00 00 00 00 86 68 fe 01 00 00 00 00 86 00040480 67 fe 01 00 00 00 00 86 66 fe 01 00 00 00 00 86 00040490 65 fe 01 00 00 00 00 86 64 fe 01 00 00 00 00 86 000404a0 63 fe 01 00 00 00 00 86 62 fe 01 00 00 00 00 86 000404b0 61 fe 01 00 00 00 00 86 60 fe 01 00 00 00 00 86 000404c0 5f fe 01 00 00 00 00 86 5e fe 01 00 00 00 00 86 000404d0 00 00 00 00 00 00 00 00 5c fe 01 00 00 00 00 86 000404e0 5b fe 01 00 00 00 00 86 5a fe 01 00 00 00 00 86 000404f0 59 fe 01 00 00 00 00 86 58 fe 01 00 00 00 00 86 00040500 00 00 00 00 00 00 00 00 56 fe 01 00 00 00 00 86 00040510 55 fe 01 00 00 00 00 86 54 fe 01 00 00 00 00 86 00040520 53 fe 01 00 00 00 00 86 52 fe 01 00 00 00 00 86 00040530 6f fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 00040540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00040550 00 00 00 00 00 00 00 00 09 15 00 00 00 00 00 86 00040560 08 15 00 00 00 00 00 86 07 15 00 00 00 00 00 86 00040570 06 15 00 00 00 00 00 86 05 15 00 00 00 00 00 86 00040580 04 15 00 00 00 00 00 86 03 15 00 00 00 00 00 86 00040590 02 15 00 00 00 00 00 86 01 15 00 00 00 00 00 86 000405a0 00 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00 000405b0 7e fe 01 00 00 00 00 86 7d fe 01 00 00 00 00 86 000405c0 7c fe 01 00 00 00 00 86 7b fe 01 00 00 00 00 86 000405d0 00 00 00 00 00 00 00 00 79 fe 01 00 00 00 00 86 000405e0 78 fe 01 00 00 00 00 86 77 fe 01 00 00 00 00 86 000405f0 76 fe 01 00 00 00 00 86 75 fe 01 00 00 00 00 86 00040600 00 00 00 00 00 00 00 00 73 fe 01 00 00 00 00 86 00040610 72 fe 01 00 00 00 00 86 1a 41 01 00 00 00 00 86 00040620 19 41 01 00 00 00 00 86 18 41 01 00 00 00 00 86 00040630 2c fe 01 00 00 00 00 86 2b fe 01 00 00 00 00 86 00040640 2a fe 01 00 00 00 00 86 29 fe 01 00 00 00 00 86 00040650 28 fe 01 00 00 00 00 86 27 fe 01 00 00 00 00 86 00040660 26 fe 01 00 00 00 00 86 25 fe 01 00 00 00 00 86 00040670 24 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 00040680 4f fe 01 00 00 00 00 86 4e fe 01 00 00 00 00 86 00040690 4d fe 01 00 00 00 00 86 4c fe 01 00 00 00 00 86 000406a0 4b fe 01 00 00 00 00 86 4a fe 01 00 00 00 00 86 000406b0 49 fe 01 00 00 00 00 86 48 fe 01 00 00 00 00 86 000406c0 47 fe 01 00 00 00 00 86 46 fe 01 00 00 00 00 86 000406d0 45 fe 01 00 00 00 00 86 44 fe 01 00 00 00 00 86 000406e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 00040730 49 ff 01 00 00 00 00 86 48 ff 01 00 00 00 00 86 00040740 47 ff 01 00 00 00 00 86 46 ff 01 00 00 00 00 86 00040750 45 ff 01 00 00 00 00 86 44 ff 01 00 00 00 00 86 00040760 02 42 01 00 00 00 00 86 3b 42 01 00 00 00 00 86 |
(2)數據區情況對比
對比bash.0.maps與bash.1.maps中的代碼區,邏輯地址範圍均是080ed000-080f2000,對應pages文件中偏移量爲00040768-000407b0,pages文件對比如下表所示,相關部分標紅。
bash.0.pages |
bash.1.pages |
00040760 a2 45 01 00 00 00 00 86 b1 45 01 00 00 00 00 86 00040770 bb 45 01 00 00 00 00 86 67 47 01 00 00 00 00 86 00040780 68 47 01 00 00 00 00 86 48 40 01 00 00 00 00 86 00040790 ba 40 01 00 00 00 00 86 b8 45 01 00 00 00 00 86 000407a0 4a 40 01 00 00 00 00 86 49 40 01 00 00 00 00 86 000407b0 b3 45 01 00 00 00 00 86 bb 40 01 00 00 00 00 86 |
00040760 02 42 01 00 00 00 00 86 3b 42 01 00 00 00 00 86 00040770 1d 42 01 00 00 00 00 86 61 40 01 00 00 00 00 86 00040780 62 40 01 00 00 00 00 86 ed 3e 01 00 00 00 00 86 00040790 d2 3e 01 00 00 00 00 86 3f 42 01 00 00 00 00 86 000407a0 d0 3e 01 00 00 00 00 86 ee 3e 01 00 00 00 00 86 000407b0 14 42 01 00 00 00 00 86 d3 3e 01 00 00 00 00 86 |
(3)動態鏈接庫情況對比
對比bash.0.maps與bash.1.maps中libc的映射區,bash.0的邏輯地址範圍是b7f37000-b8074000,對應pages文件中偏移量爲 005bf9b8-005c03a0; bash.1的邏輯地址範圍是b7e85000-b7fc2000,對應pages文件中偏移量爲 005bf428-005bfe10;pages文件對比如下表所示,相關部分標紅。
bash.0.pages |
bash.1.pages |
005bf9b0 a6 45 01 00 00 00 00 86 da ff 01 00 00 00 00 86 005bf9c0 d9 ff 01 00 00 00 00 86 d8 ff 01 00 00 00 00 86 005bf9d0 d7 ff 01 00 00 00 00 86 dd fe 01 00 00 00 00 86 005bf9e0 dc fe 01 00 00 00 00 86 db fe 01 00 00 00 00 86 005bf9f0 da fe 01 00 00 00 00 86 d9 fe 01 00 00 00 00 86 005bfa00 d8 fe 01 00 00 00 00 86 d7 fe 01 00 00 00 00 86 005bfa10 d6 fe 01 00 00 00 00 86 d5 fe 01 00 00 00 00 86 005bfa20 d4 fe 01 00 00 00 00 86 d3 fe 01 00 00 00 00 86 005bfa30 d2 fe 01 00 00 00 00 86 d1 fe 01 00 00 00 00 86 005bfa40 d0 fe 01 00 00 00 00 86 cf fe 01 00 00 00 00 86 005bfa50 ce fe 01 00 00 00 00 86 cd fe 01 00 00 00 00 86 005bfa60 cc fe 01 00 00 00 00 86 cb fe 01 00 00 00 00 86 005bfa70 00 00 00 00 00 00 00 00 c9 fe 01 00 00 00 00 86 005bfa80 c8 fe 01 00 00 00 00 86 c7 fe 01 00 00 00 00 86 005bfa90 c6 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfaa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfab0 c2 fe 01 00 00 00 00 86 de fe 01 00 00 00 00 86 005bfac0 bc 14 00 00 00 00 00 86 b3 ff 01 00 00 00 00 86 005bfad0 b2 ff 01 00 00 00 00 86 b1 ff 01 00 00 00 00 86 005bfae0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfaf0 ae ff 01 00 00 00 00 86 ad ff 01 00 00 00 00 86 005bfb00 00 00 00 00 00 00 00 00 ab ff 01 00 00 00 00 86 005bfb10 aa ff 01 00 00 00 00 86 a9 ff 01 00 00 00 00 86 005bfb20 a8 ff 01 00 00 00 00 86 a7 ff 01 00 00 00 00 86 005bfb30 a6 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfb40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfb90 00 00 00 00 00 00 00 00 97 fe 01 00 00 00 00 86 005bfba0 d2 14 00 00 00 00 00 86 d1 14 00 00 00 00 00 86 005bfbb0 d0 14 00 00 00 00 00 86 cf 14 00 00 00 00 00 86 005bfbc0 ce 14 00 00 00 00 00 86 cd 14 00 00 00 00 00 86 005bfbd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfbf0 c8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfc10 00 00 00 00 00 00 00 00 c3 14 00 00 00 00 00 86 005bfc20 e3 14 00 00 00 00 00 86 e2 14 00 00 00 00 00 86 005bfc30 e1 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfc50 dd 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfc70 00 00 00 00 00 00 00 00 f7 14 00 00 00 00 00 86 005bfc80 15 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc90 13 ff 01 00 00 00 00 86 12 ff 01 00 00 00 00 86 005bfca0 11 ff 01 00 00 00 00 86 10 ff 01 00 00 00 00 86 005bfcb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfcd0 94 ff 01 00 00 00 00 86 93 ff 01 00 00 00 00 86 005bfce0 00 00 00 00 00 00 00 00 91 ff 01 00 00 00 00 86 005bfcf0 90 ff 01 00 00 00 00 86 8f ff 01 00 00 00 00 86 005bfd00 8e ff 01 00 00 00 00 86 8d ff 01 00 00 00 00 86 005bfd10 8c ff 01 00 00 00 00 86 8b ff 01 00 00 00 00 86 005bfd20 8a ff 01 00 00 00 00 86 89 ff 01 00 00 00 00 86 005bfd30 88 ff 01 00 00 00 00 86 87 ff 01 00 00 00 00 86 005bfd40 86 ff 01 00 00 00 00 86 85 ff 01 00 00 00 00 86 005bfd50 84 ff 01 00 00 00 00 86 83 ff 01 00 00 00 00 86 005bfd60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfd70 80 ff 01 00 00 00 00 86 bf 14 00 00 00 00 00 86 005bfd80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfd90 ba ff 01 00 00 00 00 86 b9 ff 01 00 00 00 00 86 005bfda0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfde0 29 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfdf0 27 15 00 00 00 00 00 86 26 15 00 00 00 00 00 86 005bfe00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfe50 00 00 00 00 00 00 00 00 8b fe 01 00 00 00 00 86 005bfe60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfe70 88 fe 01 00 00 00 00 86 87 fe 01 00 00 00 00 86 005bfe80 86 fe 01 00 00 00 00 86 85 fe 01 00 00 00 00 86 005bfe90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bffa0 00 00 00 00 00 00 00 00 bb 14 00 00 00 00 00 86 005bffb0 ba 14 00 00 00 00 00 86 b9 14 00 00 00 00 00 86 005bffc0 b8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bffd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bffe0 00 00 00 00 00 00 00 00 b3 14 00 00 00 00 00 86 005bfff0 b2 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005c0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005c0010 ae 14 00 00 00 00 00 86 ad 14 00 00 00 00 00 86 005c0020 ac 14 00 00 00 00 00 86 ab 14 00 00 00 00 00 86 005c0030 aa 14 00 00 00 00 00 86 a9 14 00 00 00 00 00 86 005c0040 00 00 00 00 00 00 00 00 a7 14 00 00 00 00 00 86 005c0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c0090 98 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005c00a0 00 00 00 00 00 00 00 00 4b 15 00 00 00 00 00 86 005c00b0 4a 15 00 00 00 00 00 86 49 15 00 00 00 00 00 86 005c00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c01a0 00 00 00 00 00 00 00 00 ad fe 01 00 00 00 00 86 005c01b0 00 00 00 00 00 00 00 00 ab fe 01 00 00 00 00 86 005c01c0 aa fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005c01d0 00 00 00 00 00 00 00 00 a7 fe 01 00 00 00 00 86 005c01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005c01f0 a4 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005c0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c0220 9e fe 01 00 00 00 00 86 9d fe 01 00 00 00 00 86 005c0230 9c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005c0240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c0280 00 00 00 00 00 00 00 00 f5 14 00 00 00 00 00 86 005c0290 f4 14 00 00 00 00 00 86 f3 14 00 00 00 00 00 86 005c02a0 f2 14 00 00 00 00 00 86 f1 14 00 00 00 00 00 86 005c02b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005c02c0 ee 14 00 00 00 00 00 86 ed 14 00 00 00 00 00 86 005c02d0 ec 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005c02e0 ea 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005c02f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c03a0 a4 45 01 00 00 00 00 86 a8 45 01 00 00 00 00 86 |
005bf420 3d 42 01 00 00 00 00 86 da ff 01 00 00 00 00 86 005bf430 d9 ff 01 00 00 00 00 86 d8 ff 01 00 00 00 00 86 005bf440 d7 ff 01 00 00 00 00 86 dd fe 01 00 00 00 00 86 005bf450 dc fe 01 00 00 00 00 86 db fe 01 00 00 00 00 86 005bf460 da fe 01 00 00 00 00 86 d9 fe 01 00 00 00 00 86 005bf470 d8 fe 01 00 00 00 00 86 d7 fe 01 00 00 00 00 86 005bf480 d6 fe 01 00 00 00 00 86 d5 fe 01 00 00 00 00 86 005bf490 d4 fe 01 00 00 00 00 86 d3 fe 01 00 00 00 00 86 005bf4a0 d2 fe 01 00 00 00 00 86 d1 fe 01 00 00 00 00 86 005bf4b0 d0 fe 01 00 00 00 00 86 cf fe 01 00 00 00 00 86 005bf4c0 ce fe 01 00 00 00 00 86 cd fe 01 00 00 00 00 86 005bf4d0 cc fe 01 00 00 00 00 86 cb fe 01 00 00 00 00 86 005bf4e0 00 00 00 00 00 00 00 00 c9 fe 01 00 00 00 00 86 005bf4f0 c8 fe 01 00 00 00 00 86 c7 fe 01 00 00 00 00 86 005bf500 c6 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf520 c2 fe 01 00 00 00 00 86 de fe 01 00 00 00 00 86 005bf530 bc 14 00 00 00 00 00 86 b3 ff 01 00 00 00 00 86 005bf540 b2 ff 01 00 00 00 00 86 b1 ff 01 00 00 00 00 86 005bf550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf560 ae ff 01 00 00 00 00 86 ad ff 01 00 00 00 00 86 005bf570 00 00 00 00 00 00 00 00 ab ff 01 00 00 00 00 86 005bf580 aa ff 01 00 00 00 00 86 a9 ff 01 00 00 00 00 86 005bf590 a8 ff 01 00 00 00 00 86 a7 ff 01 00 00 00 00 86 005bf5a0 a6 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf5b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bf600 00 00 00 00 00 00 00 00 97 fe 01 00 00 00 00 86 005bf610 d2 14 00 00 00 00 00 86 d1 14 00 00 00 00 00 86 005bf620 d0 14 00 00 00 00 00 86 cf 14 00 00 00 00 00 86 005bf630 ce 14 00 00 00 00 00 86 cd 14 00 00 00 00 00 86 005bf640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bf660 c8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf680 00 00 00 00 00 00 00 00 c3 14 00 00 00 00 00 86 005bf690 e3 14 00 00 00 00 00 86 e2 14 00 00 00 00 00 86 005bf6a0 e1 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf6b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf6c0 dd 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf6d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf6e0 00 00 00 00 00 00 00 00 f7 14 00 00 00 00 00 86 005bf6f0 15 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf700 13 ff 01 00 00 00 00 86 12 ff 01 00 00 00 00 86 005bf710 11 ff 01 00 00 00 00 86 10 ff 01 00 00 00 00 86 005bf720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bf740 94 ff 01 00 00 00 00 86 93 ff 01 00 00 00 00 86 005bf750 00 00 00 00 00 00 00 00 91 ff 01 00 00 00 00 86 005bf760 90 ff 01 00 00 00 00 86 8f ff 01 00 00 00 00 86 005bf770 8e ff 01 00 00 00 00 86 8d ff 01 00 00 00 00 86 005bf780 8c ff 01 00 00 00 00 86 8b ff 01 00 00 00 00 86 005bf790 8a ff 01 00 00 00 00 86 89 ff 01 00 00 00 00 86 005bf7a0 88 ff 01 00 00 00 00 86 87 ff 01 00 00 00 00 86 005bf7b0 86 ff 01 00 00 00 00 86 85 ff 01 00 00 00 00 86 005bf7c0 84 ff 01 00 00 00 00 86 83 ff 01 00 00 00 00 86 005bf7d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf7e0 80 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf7f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf800 ba ff 01 00 00 00 00 86 b9 ff 01 00 00 00 00 86 005bf810 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bf850 29 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf860 27 15 00 00 00 00 00 86 26 15 00 00 00 00 00 86 005bf870 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bf8c0 00 00 00 00 00 00 00 00 8b fe 01 00 00 00 00 86 005bf8d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf8e0 88 fe 01 00 00 00 00 86 87 fe 01 00 00 00 00 86 005bf8f0 86 fe 01 00 00 00 00 86 85 fe 01 00 00 00 00 86 005bf900 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfa10 00 00 00 00 00 00 00 00 bb 14 00 00 00 00 00 86 005bfa20 ba 14 00 00 00 00 00 86 b9 14 00 00 00 00 00 86 005bfa30 b8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfa40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfa50 00 00 00 00 00 00 00 00 b3 14 00 00 00 00 00 86 005bfa60 b2 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfa70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfa80 ae 14 00 00 00 00 00 86 ad 14 00 00 00 00 00 86 005bfa90 ac 14 00 00 00 00 00 86 ab 14 00 00 00 00 00 86 005bfaa0 aa 14 00 00 00 00 00 86 a9 14 00 00 00 00 00 86 005bfab0 00 00 00 00 00 00 00 00 a7 14 00 00 00 00 00 86 005bfac0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfb00 98 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfb10 00 00 00 00 00 00 00 00 4b 15 00 00 00 00 00 86 005bfb20 4a 15 00 00 00 00 00 86 49 15 00 00 00 00 00 86 005bfb30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfc10 00 00 00 00 00 00 00 00 ad fe 01 00 00 00 00 86 005bfc20 00 00 00 00 00 00 00 00 ab fe 01 00 00 00 00 86 005bfc30 aa fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc40 00 00 00 00 00 00 00 00 a7 fe 01 00 00 00 00 86 005bfc50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfc60 a4 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfc90 9e fe 01 00 00 00 00 86 9d fe 01 00 00 00 00 86 005bfca0 9c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfcb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfcf0 00 00 00 00 00 00 00 00 f5 14 00 00 00 00 00 86 005bfd00 f4 14 00 00 00 00 00 86 f3 14 00 00 00 00 00 86 005bfd10 f2 14 00 00 00 00 00 86 f1 14 00 00 00 00 00 86 005bfd20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfd30 ee 14 00 00 00 00 00 86 ed 14 00 00 00 00 00 86 005bfd40 ec 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfd50 ea 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfd60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfe10 0a 42 01 00 00 00 00 86 06 42 01 00 00 00 00 86 |
3、不同程序對應的不同進程
註釋:此處主要是爲了說明,儘管程序不同,但程序中引用的動態鏈接庫可能是相同的(下面數據中帶*的處表明和上面的內容相同,省略。顯然可以看出有的鏈接庫bash用了,pth-memory沒有用。或者情況相反)
分析pth-memory.maps中libc的映射區,邏輯地址範圍是b7e8b000-b7fc8000,對應pages文件中偏移量爲 005bf458-005bfe40;bash.0.pages與pth-memory.pages對比如下表所示,相關部分標紅。
bash.0.pages |
pth-memory.pages |
005bf9b0 a6 45 01 00 00 00 00 86 da ff 01 00 00 00 00 86 005bf9c0 d9 ff 01 00 00 00 00 86 d8 ff 01 00 00 00 00 86 005bf9d0 d7 ff 01 00 00 00 00 86 dd fe 01 00 00 00 00 86 005bf9e0 dc fe 01 00 00 00 00 86 db fe 01 00 00 00 00 86 005bf9f0 da fe 01 00 00 00 00 86 d9 fe 01 00 00 00 00 86 005bfa00 d8 fe 01 00 00 00 00 86 d7 fe 01 00 00 00 00 86 005bfa10 d6 fe 01 00 00 00 00 86 d5 fe 01 00 00 00 00 86 005bfa20 d4 fe 01 00 00 00 00 86 d3 fe 01 00 00 00 00 86 005bfa30 d2 fe 01 00 00 00 00 86 d1 fe 01 00 00 00 00 86 005bfa40 d0 fe 01 00 00 00 00 86 cf fe 01 00 00 00 00 86 005bfa50 ce fe 01 00 00 00 00 86 cd fe 01 00 00 00 00 86 005bfa60 cc fe 01 00 00 00 00 86 cb fe 01 00 00 00 00 86 005bfa70 00 00 00 00 00 00 00 00 c9 fe 01 00 00 00 00 86 005bfa80 c8 fe 01 00 00 00 00 86 c7 fe 01 00 00 00 00 86 005bfa90 c6 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfaa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfab0 c2 fe 01 00 00 00 00 86 de fe 01 00 00 00 00 86 005bfac0 bc 14 00 00 00 00 00 86 b3 ff 01 00 00 00 00 86 005bfad0 b2 ff 01 00 00 00 00 86 b1 ff 01 00 00 00 00 86 005bfae0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfaf0 ae ff 01 00 00 00 00 86 ad ff 01 00 00 00 00 86 005bfb00 00 00 00 00 00 00 00 00 ab ff 01 00 00 00 00 86 005bfb10 aa ff 01 00 00 00 00 86 a9 ff 01 00 00 00 00 86 005bfb20 a8 ff 01 00 00 00 00 86 a7 ff 01 00 00 00 00 86 005bfb30 a6 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfb40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfb90 00 00 00 00 00 00 00 00 97 fe 01 00 00 00 00 86 005bfba0 d2 14 00 00 00 00 00 86 d1 14 00 00 00 00 00 86 005bfbb0 d0 14 00 00 00 00 00 86 cf 14 00 00 00 00 00 86 005bfbc0 ce 14 00 00 00 00 00 86 cd 14 00 00 00 00 00 86 005bfbd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfbf0 c8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfc10 00 00 00 00 00 00 00 00 c3 14 00 00 00 00 00 86 005bfc20 e3 14 00 00 00 00 00 86 e2 14 00 00 00 00 00 86 005bfc30 e1 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfc50 dd 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfc70 00 00 00 00 00 00 00 00 f7 14 00 00 00 00 00 86 005bfc80 15 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfc90 13 ff 01 00 00 00 00 86 12 ff 01 00 00 00 00 86 005bfca0 11 ff 01 00 00 00 00 86 10 ff 01 00 00 00 00 86 005bfcb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfcd0 94 ff 01 00 00 00 00 86 93 ff 01 00 00 00 00 86 005bfce0 00 00 00 00 00 00 00 00 91 ff 01 00 00 00 00 86 005bfcf0 90 ff 01 00 00 00 00 86 8f ff 01 00 00 00 00 86 005bfd00 8e ff 01 00 00 00 00 86 8d ff 01 00 00 00 00 86 005bfd10 8c ff 01 00 00 00 00 86 8b ff 01 00 00 00 00 86 005bfd20 8a ff 01 00 00 00 00 86 89 ff 01 00 00 00 00 86 005bfd30 88 ff 01 00 00 00 00 86 87 ff 01 00 00 00 00 86 005bfd40 86 ff 01 00 00 00 00 86 85 ff 01 00 00 00 00 86 005bfd50 84 ff 01 00 00 00 00 86 83 ff 01 00 00 00 00 86 005bfd60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfd70 80 ff 01 00 00 00 00 86 bf 14 00 00 00 00 00 86 005bfd80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfd90 ba ff 01 00 00 00 00 86 b9 ff 01 00 00 00 00 86 005bfda0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfde0 29 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfdf0 27 15 00 00 00 00 00 86 26 15 00 00 00 00 00 86 005bfe00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfe50 00 00 00 00 00 00 00 00 8b fe 01 00 00 00 00 86 005bfe60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfe70 88 fe 01 00 00 00 00 86 87 fe 01 00 00 00 00 86 005bfe80 86 fe 01 00 00 00 00 86 85 fe 01 00 00 00 00 86 005bfe90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bffa0 00 00 00 00 00 00 00 00 bb 14 00 00 00 00 00 86 005bffb0 ba 14 00 00 00 00 00 86 b9 14 00 00 00 00 00 86 005bffc0 b8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bffd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bffe0 00 00 00 00 00 00 00 00 b3 14 00 00 00 00 00 86 005bfff0 b2 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005c0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005c0010 ae 14 00 00 00 00 00 86 ad 14 00 00 00 00 00 86 005c0020 ac 14 00 00 00 00 00 86 ab 14 00 00 00 00 00 86 005c0030 aa 14 00 00 00 00 00 86 a9 14 00 00 00 00 00 86 005c0040 00 00 00 00 00 00 00 00 a7 14 00 00 00 00 00 86 005c0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c0090 98 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005c00a0 00 00 00 00 00 00 00 00 4b 15 00 00 00 00 00 86 005c00b0 4a 15 00 00 00 00 00 86 49 15 00 00 00 00 00 86 005c00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c01a0 00 00 00 00 00 00 00 00 ad fe 01 00 00 00 00 86 005c01b0 00 00 00 00 00 00 00 00 ab fe 01 00 00 00 00 86 005c01c0 aa fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005c01d0 00 00 00 00 00 00 00 00 a7 fe 01 00 00 00 00 86 005c01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005c01f0 a4 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005c0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c0220 9e fe 01 00 00 00 00 86 9d fe 01 00 00 00 00 86 005c0230 9c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005c0240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c0280 00 00 00 00 00 00 00 00 f5 14 00 00 00 00 00 86 005c0290 f4 14 00 00 00 00 00 86 f3 14 00 00 00 00 00 86 005c02a0 f2 14 00 00 00 00 00 86 f1 14 00 00 00 00 00 86 005c02b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005c02c0 ee 14 00 00 00 00 00 86 ed 14 00 00 00 00 00 86 005c02d0 ec 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005c02e0 ea 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005c02f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005c03a0 a4 45 01 00 00 00 00 86 a8 45 01 00 00 00 00 86 |
005bf450 86 49 01 00 00 00 00 86 da ff 01 00 00 00 00 86 005bf460 d9 ff 01 00 00 00 00 86 d8 ff 01 00 00 00 00 86 005bf470 d7 ff 01 00 00 00 00 86 dd fe 01 00 00 00 00 86 005bf480 dc fe 01 00 00 00 00 86 db fe 01 00 00 00 00 86 005bf490 da fe 01 00 00 00 00 86 d9 fe 01 00 00 00 00 86 005bf4a0 d8 fe 01 00 00 00 00 86 d7 fe 01 00 00 00 00 86 005bf4b0 d6 fe 01 00 00 00 00 86 d5 fe 01 00 00 00 00 86 005bf4c0 d4 fe 01 00 00 00 00 86 d3 fe 01 00 00 00 00 86 005bf4d0 d2 fe 01 00 00 00 00 86 d1 fe 01 00 00 00 00 86 005bf4e0 d0 fe 01 00 00 00 00 86 cf fe 01 00 00 00 00 86 005bf4f0 ce fe 01 00 00 00 00 86 cd fe 01 00 00 00 00 86 005bf500 cc fe 01 00 00 00 00 86 cb fe 01 00 00 00 00 86 005bf510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bf5a0 00 00 00 00 00 00 00 00 ab ff 01 00 00 00 00 86 005bf5b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf5c0 a8 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf5d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bf630 00 00 00 00 00 00 00 00 97 fe 01 00 00 00 00 86 005bf640 d2 14 00 00 00 00 00 86 d1 14 00 00 00 00 00 86 005bf650 d0 14 00 00 00 00 00 86 cf 14 00 00 00 00 00 86 005bf660 00 00 00 00 00 00 00 00 cd 14 00 00 00 00 00 86 005bf670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bf690 c8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf6a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf6b0 00 00 00 00 00 00 00 00 c3 14 00 00 00 00 00 86 005bf6c0 e3 14 00 00 00 00 00 86 e2 14 00 00 00 00 00 86 005bf6d0 e1 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf6e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf6f0 dd 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf710 00 00 00 00 00 00 00 00 f7 14 00 00 00 00 00 86 005bf720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf730 13 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf740 11 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf750 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bf780 00 00 00 00 00 00 00 00 91 ff 01 00 00 00 00 86 005bf790 90 ff 01 00 00 00 00 86 8f ff 01 00 00 00 00 86 005bf7a0 8e ff 01 00 00 00 00 86 8d ff 01 00 00 00 00 86 005bf7b0 8c ff 01 00 00 00 00 86 8b ff 01 00 00 00 00 86 005bf7c0 8a ff 01 00 00 00 00 86 89 ff 01 00 00 00 00 86 005bf7d0 88 ff 01 00 00 00 00 86 87 ff 01 00 00 00 00 86 005bf7e0 86 ff 01 00 00 00 00 86 85 ff 01 00 00 00 00 86 005bf7f0 84 ff 01 00 00 00 00 86 83 ff 01 00 00 00 00 86 005bf800 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bf810 80 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bf820 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bf910 00 00 00 00 00 00 00 00 87 fe 01 00 00 00 00 86 005bf920 00 00 00 00 00 00 00 00 85 fe 01 00 00 00 00 86 005bf930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfa40 00 00 00 00 00 00 00 00 bb 14 00 00 00 00 00 86 005bfa50 ba 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfa60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bfa80 00 00 00 00 00 00 00 00 b3 14 00 00 00 00 00 86 005bfa90 b2 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfaa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfab0 ae 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfac0 00 00 00 00 00 00 00 00 ab 14 00 00 00 00 00 86 005bfad0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bfb30 98 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfb40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bfc70 a8 fe 01 00 00 00 00 86 a7 fe 01 00 00 00 00 86 005bfc80 a6 fe 01 00 00 00 00 86 a5 fe 01 00 00 00 00 86 005bfc90 a4 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 005bfcc0 9e fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfcd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bfd30 f4 14 00 00 00 00 00 86 f3 14 00 00 00 00 00 86 005bfd40 00 00 00 00 00 00 00 00 f1 14 00 00 00 00 00 86 005bfd50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005bfd60 ee 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00 005bfd70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *
005bfe40 cb 3a 01 00 00 00 00 86 87 29 01 00 00 00 00 86 |