Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got the following strace output that I'm going through to teach myself a little more about the flow of programs. Here's the section that's confusing me:

16:08:02 open("/lib/libncurses.so.5", O_RDONLY) = 3 <0.000046>
16:08:02 read(3, "\x7f\"..., 512) = 512 <0.000048>
16:08:02 fstat64(3, {st_dev=makedev(202, 0), st_ino=16548, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=464, st_size=231576, st_atime=2011/02/06-15:37:43, st_mtime=2011/01/04-06:05:23, st_ctime=2011/02/06-15:37:43}) = 0 <0.000038>

What is gained by reading the first 512 bytes? It seems like this pattern is common with shared libraries.

UPDATE: I just got a great answer on that clarifies the 512 byte length. Specifically from a comment in elf/dl-load.c:

The ELF header 32-bit files is 52 bytes long and in 64-bit files is 64 bytes long. Each program header entry is again 32 and 56 bytes long respectively. I.e., even with a file which has 10 program header entries we only have to read 372B/624B respectively. Add to this a bit of margin for program notes and reading 512B and 832B for 32-bit and 64-bit files respecitvely is enough.

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

The first 512 bytes contain the header which is needed to identify the file type, target platform, version, and so on. Once the header is read, the code then jumps to the handler for this particular type of file.

share|improve this answer
    
Thank you. Where should I go to read more about this? Any good man pages for learning more? –  MLACitation Aug 13 '12 at 14:10
    
I just got a great answer on that clarifies the 512 byte length (reddit.com/r/linuxquestions/comments/y56jl/…). Specifically from a comment in elf/dl-load.c: The ELF header 32-bit files is 52 bytes long and in 64-bit files is 64 bytes long. Each program header entry is again 32 and 56 bytes long respectively. I.e., even with a file which has 10 program header entries we only have to read 372B/624B respectively. Add to this a bit of margin for program notes and reading 512B and 832B for 32-bit and 64-bit files respecitvely is enough. –  MLACitation Aug 13 '12 at 18:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.