<!DOCTYPE HTML>
<html lang="en" class="sidebar-visible no-js light">
<head>
<!-- Book generated using mdBook -->
<meta charset="UTF-8">
<title>Notes</title>
<meta name="robots" content="noindex" />
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<meta name="description" content="">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="theme-color" content="#ffffff" />
<link rel="shortcut icon" href="favicon.png">
<link rel="stylesheet" href="css/variables.css">
<link rel="stylesheet" href="css/general.css">
<link rel="stylesheet" href="css/chrome.css">
<link rel="stylesheet" href="css/print.css" media="print">
<!-- Fonts -->
<link rel="stylesheet" href="FontAwesome/css/font-awesome.css">
<link href="https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800" rel="stylesheet" type="text/css">
<link href="https://fonts.googleapis.com/css?family=Source+Code+Pro:500" rel="stylesheet" type="text/css">
<!-- Highlight.js Stylesheets -->
<link rel="stylesheet" href="highlight.css">
<link rel="stylesheet" href="tomorrow-night.css">
<link rel="stylesheet" href="ayu-highlight.css">
<!-- Custom theme stylesheets -->
</head>
<body>
<!-- Provide site root to javascript -->
<script type="text/javascript">
var path_to_root = "";
var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "light" : "light";
</script>
<!-- Work around some values being stored in localStorage wrapped in quotes -->
<script type="text/javascript">
try {
var theme = localStorage.getItem('mdbook-theme');
var sidebar = localStorage.getItem('mdbook-sidebar');
if (theme.startsWith('"') && theme.endsWith('"')) {
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
}
if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
}
} catch (e) { }
</script>
<!-- Set the theme before any content is loaded, prevents flash -->
<script type="text/javascript">
var theme;
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
if (theme === null || theme === undefined) { theme = default_theme; }
var html = document.querySelector('html');
html.classList.remove('no-js')
html.classList.remove('light')
html.classList.add(theme);
html.classList.add('js');
</script>
<!-- Hide / unhide sidebar before it is displayed -->
<script type="text/javascript">
var html = document.querySelector('html');
var sidebar = 'hidden';
if (document.body.clientWidth >= 1080) {
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
sidebar = sidebar || 'visible';
}
html.classList.remove('sidebar-visible');
html.classList.add("sidebar-" + sidebar);
</script>
<nav id="sidebar" class="sidebar" aria-label="Table of contents">
<div id="sidebar-scrollbox" class="sidebar-scrollbox">
<ol class="chapter"><li class="expanded "><a href="tools/index.html"><strong aria-hidden="true">1.</strong> Tools</a></li><li><ol class="section"><li class="expanded "><a href="tools/zsh.html"><strong aria-hidden="true">1.1.</strong> zsh</a></li><li class="expanded "><a href="tools/bash.html"><strong aria-hidden="true">1.2.</strong> bash</a></li><li class="expanded "><a href="tools/fish.html"><strong aria-hidden="true">1.3.</strong> fish</a></li><li class="expanded "><a href="tools/tmux.html"><strong aria-hidden="true">1.4.</strong> tmux</a></li><li class="expanded "><a href="tools/git.html"><strong aria-hidden="true">1.5.</strong> git</a></li><li class="expanded "><a href="tools/awk.html"><strong aria-hidden="true">1.6.</strong> awk</a></li><li class="expanded "><a href="tools/emacs.html"><strong aria-hidden="true">1.7.</strong> emacs</a></li><li class="expanded "><a href="tools/gdb.html"><strong aria-hidden="true">1.8.</strong> gdb</a></li><li class="expanded "><a href="tools/radare2.html"><strong aria-hidden="true">1.9.</strong> radare2</a></li></ol></li><li class="expanded "><a href="monitor/index.html"><strong aria-hidden="true">2.</strong> Resource analysis & monitor</a></li><li><ol class="section"><li class="expanded "><a href="monitor/lsof.html"><strong aria-hidden="true">2.1.</strong> lsof</a></li><li class="expanded "><a href="monitor/pidstat.html"><strong aria-hidden="true">2.2.</strong> pidstat</a></li><li class="expanded "><a href="monitor/pgrep.html"><strong aria-hidden="true">2.3.</strong> pgrep</a></li><li class="expanded "><a href="monitor/pmap.html"><strong aria-hidden="true">2.4.</strong> pmap</a></li><li class="expanded "><a href="monitor/pstack.html"><strong aria-hidden="true">2.5.</strong> pstack</a></li></ol></li><li class="expanded "><a href="trace_profile/index.html"><strong aria-hidden="true">3.</strong> Trace and Profile</a></li><li><ol class="section"><li class="expanded "><a href="trace_profile/strace.html"><strong aria-hidden="true">3.1.</strong> strace</a></li><li class="expanded "><a href="trace_profile/ltrace.html"><strong aria-hidden="true">3.2.</strong> ltrace</a></li><li class="expanded "><a href="trace_profile/perf.html"><strong aria-hidden="true">3.3.</strong> perf</a></li><li class="expanded "><a href="trace_profile/oprofile.html"><strong aria-hidden="true">3.4.</strong> OProfile</a></li><li class="expanded "><a href="trace_profile/time.html"><strong aria-hidden="true">3.5.</strong> time</a></li></ol></li><li class="expanded "><a href="binary/index.html"><strong aria-hidden="true">4.</strong> Binary</a></li><li><ol class="section"><li class="expanded "><a href="binary/od.html"><strong aria-hidden="true">4.1.</strong> od</a></li><li class="expanded "><a href="binary/xxd.html"><strong aria-hidden="true">4.2.</strong> xxd</a></li><li class="expanded "><a href="binary/readelf.html"><strong aria-hidden="true">4.3.</strong> readelf</a></li><li class="expanded "><a href="binary/objdump.html"><strong aria-hidden="true">4.4.</strong> objdump</a></li><li class="expanded "><a href="binary/nm.html"><strong aria-hidden="true">4.5.</strong> nm</a></li></ol></li><li class="expanded "><a href="development/index.html"><strong aria-hidden="true">5.</strong> Development</a></li><li><ol class="section"><li class="expanded "><a href="development/c++filt.html"><strong aria-hidden="true">5.1.</strong> c++filt</a></li><li class="expanded "><a href="development/c++.html"><strong aria-hidden="true">5.2.</strong> c++</a></li><li class="expanded "><a href="development/glibc.html"><strong aria-hidden="true">5.3.</strong> glibc</a></li><li class="expanded "><a href="development/gcc.html"><strong aria-hidden="true">5.4.</strong> gcc</a></li><li class="expanded "><a href="development/ld.so.html"><strong aria-hidden="true">5.5.</strong> ld.so</a></li></ol></li><li class="expanded "><a href="arch/index.html"><strong aria-hidden="true">6.</strong> Arch</a></li><li><ol class="section"><li class="expanded "><a href="arch/x86_64.html"><strong aria-hidden="true">6.1.</strong> x86_64</a></li></ol></li></ol>
</div>
<div id="sidebar-resize-handle" class="sidebar-resize-handle"></div>
</nav>
<div id="page-wrapper" class="page-wrapper">
<div class="page">
<div id="menu-bar" class="menu-bar">
<div id="menu-bar-sticky-container">
<div class="left-buttons">
<button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
<i class="fa fa-bars"></i>
</button>
<button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
<i class="fa fa-paint-brush"></i>
</button>
<ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
<li role="none"><button role="menuitem" class="theme" id="light">Light (default)</button></li>
<li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li>
<li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li>
<li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li>
<li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li>
</ul>
<button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
<i class="fa fa-search"></i>
</button>
</div>
<h1 class="menu-title">Notes</h1>
<div class="right-buttons">
<a href="print.html" title="Print this book" aria-label="Print this book">
<i id="print-button" class="fa fa-print"></i>
</a>
</div>
</div>
</div>
<div id="search-wrapper" class="hidden">
<form id="searchbar-outer" class="searchbar-outer">
<input type="search" name="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
</form>
<div id="searchresults-outer" class="searchresults-outer hidden">
<div id="searchresults-header" class="searchresults-header"></div>
<ul id="searchresults">
</ul>
</div>
</div>
<!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
<script type="text/javascript">
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
});
</script>
<div id="content" class="content">
<main>
<h1><a class="header" href="#tools" id="tools">Tools</a></h1>
<ul>
<li><a href="tools/./zsh.html">zsh</a></li>
<li><a href="tools/./bash.html">bash</a></li>
<li><a href="tools/./fish.html">fish</a></li>
<li><a href="tools/./tmux.html">tmux</a></li>
<li><a href="tools/./git.html">git</a></li>
<li><a href="tools/./awk.html">awk</a></li>
<li><a href="tools/./emacs.html">emacs</a></li>
<li><a href="tools/./gdb.html">gdb</a></li>
<li><a href="tools/./radare2.html">radare2</a></li>
</ul>
<h1><a class="header" href="#zsh1" id="zsh1">zsh(1)</a></h1>
<h2><a class="header" href="#keybindings" id="keybindings">Keybindings</a></h2>
<p>Change input mode:</p>
<pre><code class="language-zsh">bindkey -v change to vi keymap
bindkey -e change to emacs keymap
</code></pre>
<p>Define key-mappings:</p>
<pre><code class="language-zsh">bindkey list mappings in current keymap
bindkey in-str cmd create mapping for `in-str` to `cmd`
bindkey -r in-str remove binding for `in-str`
# C-v <key> dump <key> code, which can be used in `in-str`
# zle -l list all functions for keybindings
# man zshzle(1) STANDARD WIDGETS: get description of functions
</code></pre>
<h2><a class="header" href="#completion" id="completion">Completion</a></h2>
<h3><a class="header" href="#installation" id="installation">Installation</a></h3>
<p>Completion functions are provided via files and need to be placed in a location
covered by <code>$fpath</code>. By convention the completion files are names as <code>_<CMD></code>.</p>
<p>A completion skeleton for the command <code>foo</code>, stored in <code>_foo</code></p>
<pre><code class="language-zsh">#compdef _foo foo
function _foo() {
...
}
</code></pre>
<p>Alternatively one can install a completion function explicitly by calling <code>compdef <FUNC> <CMD></code>.</p>
<h3><a class="header" href="#completion-variables" id="completion-variables">Completion Variables</a></h3>
<p>Following variables are available in Completion functions:</p>
<pre><code class="language-zsh">$words # array with command line in words
$#words # number words
$CURRENT # index into $words for cursor position
$words[CURRENT-1] # previous word (relative to cursor position)
</code></pre>
<h3><a class="header" href="#completion-functions" id="completion-functions">Completion Functions</a></h3>
<ul>
<li><code>_describe</code> simple completion, just words + description</li>
<li><code>_arguments</code> sophisticated completion, allow to specify actions</li>
</ul>
<h4><a class="header" href="#completion-with-a-hrefhttpzshsourceforgenetdocreleasecompletion-systemhtmlcompletion-functions_describea" id="completion-with-a-hrefhttpzshsourceforgenetdocreleasecompletion-systemhtmlcompletion-functions_describea">Completion with <a href="http://zsh.sourceforge.net/Doc/Release/Completion-System.html#Completion-Functions"><code>_describe</code></a></a></h4>
<pre><code class="language-zsh">_describe MSG COMP
</code></pre>
<ul>
<li><code>MSG</code> simple string with header message</li>
<li><code>COMP</code> array of completions where each entry is <code>"opt:description"</code></li>
</ul>
<pre><code class="language-zsh">function _foo() {
local -a opts
opts=('bla:desc for bla' 'blu:desc for blu')
_describe 'foo-msg' opts
}
compdef _foo foo
foo <TAB><TAB>
-- foo-msg --
bla -- desc for bla
blu -- desc for blu
</code></pre>
<h4><a class="header" href="#completion-with-a-hrefhttpzshsourceforgenetdocreleasecompletion-systemhtmlcompletion-functions_argumentsa" id="completion-with-a-hrefhttpzshsourceforgenetdocreleasecompletion-systemhtmlcompletion-functions_argumentsa">Completion with <a href="http://zsh.sourceforge.net/Doc/Release/Completion-System.html#Completion-Functions"><code>_arguments</code></a></a></h4>
<pre><code class="language-zsh">_arguments SPEC [SPEC...]
</code></pre>
<p>where <code>SPEC</code> can have one of the following forms:</p>
<ul>
<li><code>OPT[DESC]:MSG:ACTION</code></li>
<li><code>N:MSG:ACTION</code></li>
</ul>
<p>Available actions</p>
<pre><code class="language-zsh">(op1 op2) list possible matches
->VAL set $state=VAL and continue, `$state` can be checked later in switch case
FUNC call func to generate matches
{STR} evaluate `STR` to generate matches
</code></pre>
<h3><a class="header" href="#example" id="example">Example</a></h3>
<p>Skeleton to copy/paste for writing simple completions.</p>
<p>Assume a program <code>foo</code> with the following interface:</p>
<pre><code class="language-zsh">foo -c green|red|blue -s low|high -f <file> -d <dir> -h
</code></pre>
<p>The completion handler could be implemented as follows in a file called <code>_foo</code>:</p>
<pre><code class="language-zsh">#compdef _foo foo
function _foo_color() {
local colors=()
colors+=('green:green color')
colors+=('red:red color')
colors+=('blue:blue color')
_describe "color" colors
}
function _foo() {
_arguments \
"-c[define color]:color:->s_color" \
"-s[select sound]:color:(low high)" \
"-f[select file]:file:_files" \
"-d[select dir]:fir:_files -/" \
"-h[help]"
case $state in
s_color) _foo_color;;
esac
}
</code></pre>
<h1><a class="header" href="#bash1" id="bash1">bash(1)</a></h1>
<h2><a class="header" href="#expansion" id="expansion">Expansion</a></h2>
<h3><a class="header" href="#generator" id="generator">Generator</a></h3>
<pre><code class="language-bash"># generate sequence from n to m
{n..m}
# generate sequence from n to m step by s
{n..m..s}
# expand cartesian product
{a,b}{c,d}
</code></pre>
<h3><a class="header" href="#parameter" id="parameter">Parameter</a></h3>
<pre><code class="language-bash"># default param
bar=${foo:-some_val} # if $foo set, then bar=$foo else bar=some_val
# check param set
bar=${foo:?msg} # if $foo set, then bar=$foo else exit and print msg
# indirect
FOO=foo
BAR=FOO
bar=${!BAR} # deref value of BAR -> bar=$FOO
# prefix
${foo#prefix} # remove prefix when expanding $foo
# suffix
${foo%suffix} # remove suffix when expanding $foo
# substitute
${foo/pattern/string} # replace pattern with string when expanding foo
# pattern starts with
# '/' replace all occurences of pattern
# '#' pattern match at beginning
# '%' pattern match at end
</code></pre>
<blockquote>
<p>Note: <code>prefix</code>/<code>suffix</code>/<code>pattern</code> are expanded as <a href="tools/bash.html#pathname">pathnames</a>.</p>
</blockquote>
<h3><a class="header" href="#pathname" id="pathname">Pathname</a></h3>
<pre><code class="language-bash">* match any string
? match any single char
\\ match backslash
[abc] match any char of 'a' 'b' 'c'
[a-z] match any char between 'a' - 'z'
[^ab] negate, match all not 'a' 'b'
[:class:] match any char in class, available:
alnum,alpha,ascii,blank,cntrl,digit,graph,lower,
print,punct,space,upper,word,xdigit
</code></pre>
<p>Wit <code>extglob</code> shell option enabled it is possible to have more powerful
patterns. In the following <code>pattern-list</code> is one ore more patterns separated
by <code>|</code> char.</p>
<pre><code class="language-bash">?(pattern-list) matches zero or one occurrence of the given patterns
*(pattern-list) matches zero or more occurrences of the given patterns
+(pattern-list) matches one or more occurrences of the given patterns
@(pattern-list) matches one of the given patterns
!(pattern-list) matches anything except one of the given patterns
</code></pre>
<blockquote>
<p>Note: <code>shopt -s extglob</code>/<code>shopt -u extglob</code> to enable/disable <code>extglob</code>
option.</p>
</blockquote>
<h2><a class="header" href="#io-redirection" id="io-redirection">I/O redirection</a></h2>
<blockquote>
<p>Note: The trick with bash I/O redirection is to interpret from left-to-right.</p>
</blockquote>
<pre><code class="language-bash"># stdout & stderr to file
command >file 2>&1
# equivalent
command &>file
# stderr to stdout & stdout to file
command 2>&1 >file
</code></pre>
<h3><a class="header" href="#explanation" id="explanation">Explanation</a></h3>
<pre><code class="language-bash">j>&i
</code></pre>
<p>Duplicate <code>fd i</code> to <code>fd j</code>, making <code>j</code> a copy of <code>i</code>. See <a href="http://man7.org/linux/man-pages/man2/dup.2.html">dup2(2)</a>.</p>
<p>Example:</p>
<pre><code class="language-bash">command 2>&1 >file
</code></pre>
<ol>
<li>duplicate <code>fd 1</code> to <code>fd 2</code>, effectively redirecting <code>stderr</code> to <code>stdout</code></li>
<li>redirect <code>stdout</code> to <code>file</code></li>
</ol>
<h2><a class="header" href="#completion-1" id="completion-1">Completion</a></h2>
<p>The <code>complete</code> builtin is used to interact with the completion system.</p>
<pre><code class="language-bash">complete # print currently installed completion handler
complete -F <func> <cmd> # install <func> as completion handler for <cmd>
complete -r <cmd> # uninstall completion handler for <cmd>
</code></pre>
<p>Variables available in completion functions:</p>
<pre><code class="language-bash"># in
$1 # <cmd>
$2 # current word
$3 # privous word
COMP_WORDS # array with current command line words
COMP_CWORD # index into COMP_WORDS with current cursor position
# out
COMPREPLY # array with possible completions
</code></pre>
<p>The <code>compgen</code> builtin is used to generate possible matches by comparing <code>word</code>
against words generated by <code>option</code>.</p>
<pre><code class="language-bash">compgen [option] [word]
# usefule options:
# -W <list> specify list of possible completions
# -d generate list with dirs
# -f generate list with files
# -u generate list with users
# -e generate list with exported variables
# compare "f" against words "foo" "foobar" "bar" and generate matches
compgen -W "foo foobar bar" "f"
# compare "hom" against file/dir names and generate matches
compgen -d -f "hom"
</code></pre>
<h3><a class="header" href="#example-1" id="example-1">Example</a></h3>
<p>Skeleton to copy/paste for writing simple completions.</p>
<p>Assume a program <code>foo</code> with the following interface:</p>
<pre><code class="language-bash">foo -c green|red|blue -s low|high -f <file> -h
</code></pre>
<p>The completion handler could be implemented as follows:</p>
<pre><code class="language-bash">function _foo() {
local curr=$2
local prev=$3
local opts="-c -s -f -h"
case $prev in
-c) COMPREPLY=( $(compgen -W "green red blue" -- $curr) );;
-s) COMPREPLY=( $(compgen -W "low high" -- $curr) );;
-f) COMPREPLY=( $(compgen -f -- $curr) );;
*) COMPREPLY=( $(compgen -W "$opts" -- $curr) );;
esac
}
complete -F _foo foo
</code></pre>
<h1><a class="header" href="#fish1" id="fish1">fish(1)</a></h1>
<h2><a class="header" href="#quick-info" id="quick-info">Quick Info</a></h2>
<p>Fish initialization file <code>~/.config/fish/config.fish</code></p>
<p>Switch between different key bindings:</p>
<ul>
<li><code>fish_default_key_bindings</code> to use default key bindings</li>
<li><code>fish_vi_key_bindings</code> to use vi key bindings</li>
</ul>
<h2><a class="header" href="#variables" id="variables">Variables</a></h2>
<p>Available scopes</p>
<ul>
<li><code>local</code> variable local to a block</li>
<li><code>global</code> variable global to shell instance</li>
<li><code>universal</code> variable universal to all shell instances + preserved across
shell restart</li>
</ul>
<h3><a class="header" href="#setunset-variables" id="setunset-variables">Set/Unset Variables</a></h3>
<pre><code class="language-text">set <name> [<values>]
-l local scope
-g global scope
-U universal scope
-e erase variable
-S show verbose info
-x export to ENV
-u unexport from ENV
</code></pre>
<h3><a class="header" href="#lists" id="lists">Lists</a></h3>
<p>In <code>fish</code> all variables are lists (start with index <code>1</code>, but lists can't
contain lists.</p>
<pre><code class="language-text">set foo a b c d
echo $foo[1] # a
echo $foo[-1] # d
echo $foo[2..3] # b c
echo $foo[1 3] # a c
</code></pre>
<p><code>$</code> can be seen as dereference operator.</p>
<pre><code class="language-text">set foo a; set a 1337
echo $$foo # outputs 1337
</code></pre>
<p>Cartesian product.</p>
<pre><code class="language-text">echo file.{h,cc}
# file.h file.cc
echo {a,b}{1,2}
# a1 b1 b2
</code></pre>
<h3><a class="header" href="#special-variables-lists" id="special-variables-lists">Special Variables (Lists)</a></h3>
<pre><code class="language-text">$status # exit code of last command
$pipestatus # list of exit codes of pipe chain
$CMD_DURATION # runtime of last command in ms
</code></pre>
<h4><a class="header" href="#path" id="path"><code>*PATH</code></a></h4>
<p>Lists ending with <code>PATH</code> are automatically split at <code>:</code> when used and joined
with <code>:</code> when exported to the environment.</p>
<pre><code class="language-text">set -x BLA_PATH a:b:c:d
echo $BLA_PATH # a b c d
env | grep BLA_PATH # BLA_PATH=a:b:c:d
</code></pre>
<h2><a class="header" href="#command-handling" id="command-handling">Command Handling</a></h2>
<pre><code class="language-text"># sub-commands are not run in quotes
echo "ls output: "(ls)
</code></pre>
<h3><a class="header" href="#io-redirection-1" id="io-redirection-1">I/O redirection</a></h3>
<pre><code class="language-text"># 'noclobber', fail if 'log' already exists
echo foo >? log
</code></pre>
<h2><a class="header" href="#control-flow" id="control-flow">Control Flow</a></h2>
<h3><a class="header" href="#if--else" id="if--else"><code>if</code> / <code>else</code></a></h3>
<pre><code class="language-text">if grep foo bar
# do sth
else if grep foobar bar
# do sth else
else
# do sth else
end
</code></pre>
<h3><a class="header" href="#switch" id="switch"><code>switch</code></a></h3>
<pre><code class="language-text">switch (echo foo)
case 'foo*'
# do start with foo
case bar dudel
# do bar and dudel
case '*'
# do else
end
</code></pre>
<h3><a class="header" href="#while-loop" id="while-loop"><code>while</code> Loop</a></h3>
<pre><code class="language-text">while true
echo foo
end
</code></pre>
<h3><a class="header" href="#for-loop" id="for-loop"><code>for</code> Loop</a></h3>
<pre><code class="language-text">for f in (ls)
echo $f
end
</code></pre>
<h2><a class="header" href="#functions" id="functions">Functions</a></h2>
<p>Function arguments are passed via <code>$argv</code> list.</p>
<pre><code class="language-text">function fn_foo
echo $argv
end
</code></pre>
<h3><a class="header" href="#autoloading" id="autoloading">Autoloading</a></h3>
<p>When running a command fish attempts to autoload a function. The shell looks
for <code><cmd>.fish</code> in the locations defined by <code>$fish_function_path</code> and loads
the function lazily if found.</p>
<p>This is the preferred way over monolithically defining all functions in a
startup script.</p>
<h3><a class="header" href="#helper" id="helper">Helper</a></h3>
<pre><code class="language-text">functions # list al functions
functions foo # describe function 'foo'
functions -e foo # erase function 'foo'
funced foo # edit function 'foo'
# '-e vim' to edit in vim
</code></pre>
<h2><a class="header" href="#prompt" id="prompt">Prompt</a></h2>
<p>The prompt is defined by the output of the <code>fish_prompt</code> function.</p>
<pre><code class="language-text">function fish_prompt
set -l cmd_ret
echo "> "(pwd) $cmd_ret" "
end
</code></pre>
<blockquote>
<p>Use <code>set_color</code> to manipulate terminal colors.</p>
</blockquote>
<h2><a class="header" href="#useful-builtins" id="useful-builtins">Useful Builtins</a></h2>
<pre><code class="language-text"># history
history search <str> # search history for <str>
history merge # merge histories from fish sessions
# list
count $var # count elements in list
# string
string split SEP STRING
</code></pre>
<h2><a class="header" href="#keymaps" id="keymaps">Keymaps</a></h2>
<pre><code class="language-text"> Shift-Tab ........... tab-completion with search
Alt-Up / Alt-Down ... search history with token under the cursor
Alt-l ............... list content of dir under cursor
Alt-p ............... append '2>&1 | less;' to current cmdline
</code></pre>
<h2><a class="header" href="#debug" id="debug">Debug</a></h2>
<pre><code class="language-text"> status print-stack-trace .. prints function stacktrace (can be used in scripts)
breakpoint ................ halt script execution and gives shell (C-d | exit
to continue)
</code></pre>
<h1><a class="header" href="#tmux1" id="tmux1">tmux(1)</a></h1>
<p>Terminology:</p>
<ul>
<li><code>session</code> is a collection of pseudo terminals which can have multiple
<code>windows</code></li>
<li><code>window</code> uses the entire screen and can be split into rectangular <code>panes</code></li>
<li><code>pane</code> is a single pseudo terminal instance</li>
</ul>
<h1><a class="header" href="#tmux-cli" id="tmux-cli">Tmux cli</a></h1>
<pre><code class="language-markdown"># Session
tmux creates new session
tmux ls list running sessions
tmux kill-session -t <s> kill running session <s>
tmux attach -t <s> [-d] attach to session <s>, detach other clients [-d]
tmux detach -s <s> detach all clients from session <s>
# Environment
tmux showenv -g show global tmux environment variables
tmux setenv -g <var> <val> set variable in global tmux env
# Misc
tmux source-file <file> source config <file>
tmux lscm list available tmux commnds
tmux show -g show global tmux options
tmux display <msg> display message in tmux status line
</code></pre>
<h2><a class="header" href="#scripting" id="scripting">Scripting</a></h2>
<pre><code class="language-markdown"># Session
tmux list-sessions -F '#S' list running sessions, only IDs
# Window
tmux list-windows -F '#I' -t <s> list window IDs for session <s>
tmux selectw -t <s>:<w> select window <w> in session <s>
# Pane
tmux list-panes -F '#P' -t <s>:<w> list pane IDs for window <w> in session <s>
tmux selectp -t <s>:<w>.<p> select pane <p> in window <w> in session <s>
# Run commands
tmux send -t <s>:<w>.<p> "ls" C-m send cmds/keys to pane
tmux run -t <p> <sh-cmd> run shell command <sh-cmd> in background and report output on pane -t <p>
</code></pre>
<p>For example cycle through all panes in all windows in all sessions:</p>
<pre><code class="language-bash"># bash
for s in $(tmux list-sessions -F '#S'); do
for w in $(tmux list-windows -F '#I' -t $s); do
for p in $(tmux list-panes -F '#P' -t $s:$w); do
echo $s:$w.$p
done
done
done
</code></pre>
<h1><a class="header" href="#bindings" id="bindings">Bindings</a></h1>
<pre><code class="language-markdown">prefix d detach from current session
prefix c create new window
prefix w open window list
prefix $ rename session
prefix , rename window
prefix . move current window
</code></pre>
<p>Following bindings are specific to my <a href="https://github.com/johannst/dotfiles/blob/master/tmux.conf"><code>tmux.conf</code></a>:</p>
<pre><code class="language-markdown">C-s prefix
# Panes
prefix s horizontal split
prefix v vertical split
prefix f toggle maximize/minimize current pane
# Movement
prefix Tab toggle between window
prefix h move to pane left
prefix j move to pane down
prefix k move to pane up
prefix l move to pane right
# Resize
prefix C-h resize pane left
prefix C-j resize pane down
prefix C-k resize pane up
prefix C-l resize pane right
# Copy/Paste
prefix C-v enter copy mode
prefix C-p paste yanked text
prefix C-b open copy-buffer list
# In Copy Mode
v enable visual mode
y yank selected text
</code></pre>
<h1><a class="header" href="#command-mode" id="command-mode">Command mode</a></h1>
<p>To enter command mode <code>prefix :</code>.</p>
<p>Some useful commands are:</p>
<pre><code class="language-markdown">setw synchronize-panes on/off enables/disables synchronized input to all panes
list-keys -t vi-copy list keymaps for vi-copy mode
</code></pre>
<h1><a class="header" href="#git1" id="git1">git(1)</a></h1>
<h2><a class="header" href="#staging" id="staging">staging</a></h2>
<pre><code class="language-markdown"> git add -p [<file>] ............ partial staging (interactive)
</code></pre>
<h2><a class="header" href="#remote" id="remote">Remote</a></h2>
<pre><code class="language-markdown"> git remote -v .................. list remotes verbose (with URLs)
git remote show [-n] <remote> .. list info for <remote> (like remote HEAD,
remote branches, tracking mapping)
</code></pre>
<h2><a class="header" href="#branching" id="branching">Branching</a></h2>
<pre><code class="language-markdown"> git branch [-a] ................ list available branches; -a to include
remote branches
git branch -vv ................. list branch & annotate with head sha1 &
remote tracking branch
git branch <bname> ............. create branch with name <bname>
git checkout <bname> ........... switch to branch with name <bname>
git checkout --track <branch> .. start to locally track a remote branch
git push -u origin <rbname> .... push branch to origin (or other remote), and
setup <rbname> as tracking branch
</code></pre>
<h2><a class="header" href="#resetting" id="resetting">Resetting</a></h2>
<pre><code class="language-markdown"> git reset [opt] <ref|commit>
opt:
--mixed .................... resets index, but not working tree
--hard ..................... matches the working tree and index to that
of the tree being switched to any changes to
tracked files in the working tree since
<commit> are lost
git reset HEAD <file> .......... remove file from staging
git reset --soft HEAD~1 ........ delete most recent commit but keep work
git reset --hard HEAD~1 ........ delete most recent commit and delete work
</code></pre>
<h2><a class="header" href="#tags" id="tags">Tags</a></h2>
<pre><code class="language-markdown"> git tag -a <tname> -m "descr" ........ creates an annotated tag (full object
containing tagger, date, ...)
git tag -l ........................... list available tags
git checkout tag/<tname> ............. checkout specific tag
git checkout tag/<tname> -b <bname> .. checkout specific tag in a new branch
</code></pre>
<h2><a class="header" href="#diff" id="diff">Diff</a></h2>
<pre><code class="language-markdown"> git diff HEAD:<fname> origin/HEAD:<fname> ... diff files for different refs
git diff -U$(wc -l <fname>) <fname> ......... shows complete file with diffs
instead of usual diff snippets
</code></pre>
<h2><a class="header" href="#log" id="log">Log</a></h2>
<pre><code class="language-markdown"> git log --oneline .... shows log in single line per commit -> alias for
'--pretty=oneline --abbrev-commit'
git log --graph ...... text based graph of commit history
git log --decorate ... decorate log with REFs
</code></pre>
<h2><a class="header" href="#file-history" id="file-history">File history</a></h2>
<pre><code class="language-markdown"> git log -p <file> ......... show commit history + diffs for <file>
git log --oneline <file> .. show commit history for <file> in compact format
</code></pre>
<h2><a class="header" href="#patching" id="patching">Patching</a></h2>
<pre><code class="language-markdown"> git format-patch <opt> <since>/<revision range>
opt:
-N ................... use [PATCH] instead [PATCH n/m] in subject when
generating patch description (for patches spanning
multiple commits)
--start-number <n> ... start output file generation with <n> as start
number instead '1'
since spcifier:
-3 .................. e.g: create a patch from last three commits
<commit hash> ....... create patch with commits starting after <commit hash>
git am <patch> ......... apply patch and create a commit for it
git apply --stat <PATCH> ... see which files the patch would change
git apply --check <PATCH> .. see if the patch can be applied cleanly
git apply <PATCH> .......... apply the patch locally without creating a commit
# eg: generate patches for each commit from initial commit on
git format-patch -N $(git rev-list --max-parents=0 HEAD)
# generate single patch file from a certain commit/ref
git format-patch <COMMIT/REF> --stdout > my-patch.patch
</code></pre>
<h2><a class="header" href="#submodules" id="submodules">Submodules</a></h2>
<pre><code class="language-markdown"> git submodule add <url> [<path>] .......... add new submodule to current project
git clone --recursive <url> ............... clone project and recursively all
submodules (same as using
'git submodule update --init
--recursive' after clone)
git submodule update --init --recursive ... checkout submodules recursively
using the commit listed in the
super-project (in detached HEAD)
git submodule update --remote <submod> .... fetch & merge remote changes for
<submod>, this will pull
origin/HEAD or a branch specified
for the submodule
git diff --submodule ...................... show commits that are part of the
submodule diff
</code></pre>
<h2><a class="header" href="#inspection" id="inspection">Inspection</a></h2>
<pre><code class="language-markdown"> git ls-tree [-r] <ref> .... show git tree for <ref>, -r to recursively ls sub-trees
git show <obj> ............ show <obj>
git cat-file -p <obj> ..... print content of <obj>
</code></pre>
<h2><a class="header" href="#revision-specifier" id="revision-specifier">Revision Specifier</a></h2>
<pre><code class="language-markdown"> HEAD ........ last commit
HEAD~1 ...... last commit-1
HEAD~N ...... last commit-N (linear backwards when in tree structure, check
difference between HEAD^ and HEAD~)
git rev-list --max-parents=0 HEAD ........... first commit
</code></pre>
<h1><a class="header" href="#awk1" id="awk1">awk(1)</a></h1>
<pre><code class="language-markdown">awk [opt] program [input]
-F <sepstr> field separator string (can be regex)
program awk program
input file or stdin if not file given
</code></pre>
<h2><a class="header" href="#input-processing" id="input-processing">Input processing</a></h2>
<p>Input is processed in two stages:</p>
<ol>
<li>Splitting input into a sequence of <code>records</code>.
By default split at <code>newline</code> character, but can be changed via the
builtin <code>RS</code> variable.</li>
<li>Splitting a <code>record</code> into <code>fields</code>. By default strings without <code>whitespace</code>,
but can be changed via the builtin variable <code>FS</code> or command line option
<code>-F</code>.</li>
</ol>
<p>Fields are accessed as follows:</p>
<ul>
<li><code>$0</code> whole <code>record</code></li>
<li><code>$1</code> field one</li>
<li><code>$2</code> field two</li>
<li>...</li>
</ul>
<h2><a class="header" href="#program" id="program">Program</a></h2>
<p>An <code>awk</code> program is composed of pairs of the form:</p>
<pre><code class="language-markdown">pattern { action }
</code></pre>
<p>The program is run against each <code>record</code> in the input stream. If a <code>pattern</code>
matches a <code>record</code> the corresponding <code>action</code> is executed and can access the
<code>fields</code>.</p>
<pre><code class="language-markdown">INPUT
|
v
record ----> ∀ pattern matched
| |
v v
fields ----> run associated action
</code></pre>
<p>Any valid awk <code>expr</code> can be a <code>pattern</code>.</p>
<h3><a class="header" href="#special-pattern" id="special-pattern">Special pattern</a></h3>
<p>awk provides two special patterns, <code>BEGIN</code> and <code>END</code>, which can be used
multiple times. Actions with those patterns are <strong>executed exactly once</strong>.</p>
<ul>
<li><code>BEGIN</code> actions are run before processing the first record</li>
<li><code>END</code> actions are run after processing the last record</li>
</ul>
<h3><a class="header" href="#special-variables" id="special-variables">Special variables</a></h3>
<ul>
<li><code>RS</code> <em>record separator</em>: first char is the record separator, by default
<newline></li>
<li><code>FS</code> <em>field separator</em>: regex to split records into fields, by default
<space></li>
<li><code>NR</code> <em>number record</em>: number of current record</li>
</ul>
<h3><a class="header" href="#special-statements--functions" id="special-statements--functions">Special statements & functions</a></h3>
<ul>
<li>
<p><code>printf "fmt", args...</code></p>
<p>Print format string, args are comma separated.</p>
<ul>
<li><code>%s</code> string</li>
<li><code>%d</code> decimal</li>
<li><code>%x</code> hex</li>
<li><code>%f</code> float</li>
</ul>
<p>Width can be specified as <code>%Ns</code>, this reserves <code>N</code> chars for a string.
For floats one can use <code>%N.Mf</code>, <code>N</code> is the total number including <code>.</code> and
<code>M</code>.</p>
</li>
<li>
<p><code>strftime("fmt")</code></p>
<p>Print time stamp formatted by <code>fmt</code>.</p>
<ul>
<li><code>%Y</code> full year (eg 2020)</li>
<li><code>%m</code> month (01-12)</li>
<li><code>%d</code> day (01-31)</li>
<li><code>%F</code> alias for <code>%Y-%m-%d</code></li>
<li><code>%H</code> hour (00-23)</li>
<li><code>%M</code> minute (00-59)</li>
<li><code>%S</code> second (00-59)</li>
<li><code>%T</code> alias for <code>%H:%M:%S</code></li>
</ul>
</li>
</ul>
<h2><a class="header" href="#examples" id="examples">Examples</a></h2>
<h3><a class="header" href="#filter-records" id="filter-records">Filter records</a></h3>
<pre><code class="language-bash">awk 'NR%2 == 0 { print $0 }' <file>
</code></pre>
<p>The pattern <code>NR%2 == 0</code> matches every second record and the action <code>{ print $0 }</code>
prints the whole record.</p>
<h3><a class="header" href="#capture-in-variables" id="capture-in-variables">Capture in variables</a></h3>
<pre><code class="language-bash"># /proc/<pid>/status
# Name: cat
# ...
# VmRSS: 516 kB
# ...
for f in /proc/*/status; do
cat $f | awk '
/^VmRSS/ { rss = $2/1024 }
/^Name/ { name = $2 }
END { printf "%16s %6d MB\n", name, rss }';
done | sort -k2 -n
</code></pre>
<p>We capture values from <code>VmRSS</code> and <code>Name</code> into variables and print them at the
<code>END</code> once processing all records is done.</p>
<h3><a class="header" href="#run-shell-command-and-capture-output" id="run-shell-command-and-capture-output">Run shell command and capture output</a></h3>
<pre><code class="language-bash">cat /proc/1/status | awk '
/^Pid/ {
"ps --no-header -o user " $2 | getline user;
print user
}'
</code></pre>
<p>We build a <code>ps</code> command line and capture the first line of the processes output
in the <code>user</code> variable and then print it.</p>
<h1><a class="header" href="#emacs1" id="emacs1">emacs(1)</a></h1>
<h2><a class="header" href="#help" id="help">help</a></h2>
<pre><code class="language-markdown"> C-h ? list available help modes
C-h f describe function
C-h v describe variable
C-h c <KEY> print command bound to <KEY>
C-h k <KEY> describe command bound to <KEY>
C-h b list buffer local key-bindings
<kseq> C-h list possible key-bindings with <kseq>
eg C-x C-h -> list key-bindings beginning with C-x
</code></pre>
<h2><a class="header" href="#package-manager" id="package-manager">package manager</a></h2>
<pre><code class="language-markdown"> package-refresh-contents refresh package list
package-list-packages list available/installed packages
</code></pre>
<h2><a class="header" href="#window" id="window">window</a></h2>
<pre><code class="language-markdown"> C-x 0 kill focused window
C-x 1 kill all other windows
C-x 2 split horizontal
C-x 3 split vertical
</code></pre>
<h2><a class="header" href="#yankpaste" id="yankpaste">yank/paste</a></h2>
<pre><code class="language-markdown"> C-<SPACE> set start mark to select text
M-w copy selected text
C-w kill selected text
C-y paste selected text
M-y cycle through kill-ring
</code></pre>
<h2><a class="header" href="#blockrect" id="blockrect">block/rect</a></h2>
<pre><code class="language-markdown"> C-x <SPC> activate rectangle-mark-mode
M-x string-rectangle <RET> insert text in marked rect
</code></pre>
<h2><a class="header" href="#mass-edit" id="mass-edit">mass edit</a></h2>
<pre><code class="language-makrdown"> C-x h mark whole buffer (mark-whole-buffer)
M-x delete-matching-line <RET> delete lines matching regex
M-x % search & replace region (query-replace)
C-M-x % search & replace regex (query-replace-regexp)
</code></pre>
<h2><a class="header" href="#grep" id="grep">grep</a></h2>
<pre><code class="language-markdown"> M-x find-grep <RET> run find-grep result in *grep* buffer
n/p navigate next/previous match in *grep* buffer
</code></pre>
<h2><a class="header" href="#lisp-mode" id="lisp-mode">lisp mode</a></h2>
<pre><code class="language-markdown"> M-x lisp-interaction-mode activate lisp mode
C-M-x evaluate top expr under cursor
C-x C-e eval-last-sexp
C-u C-x C-e eval-last-sexp and prints result in current buffer
</code></pre>
<h2><a class="header" href="#narrow" id="narrow">narrow</a></h2>
<pre><code class="language-markdown"> C-x n n show only focused region (narrow)
C-x n w show whole buffer (wide)
</code></pre>
<h2><a class="header" href="#org" id="org">org</a></h2>
<pre><code class="language-markdown"> M-up/M-down re-arrange items in same hierarchy
M-left/M-right change item hierarchy
C-RET create new item below current
C-S-RET create new TODO item below current
S-left/S-right cycle TODO states
</code></pre>
<h3><a class="header" href="#org-source" id="org-source">org source</a></h3>
<pre><code class="language-markdown"> <s TAB generate a source block
C-c ' edit source block (in lang specific buffer)
C-c C-c eval source block
</code></pre>
<h1><a class="header" href="#gdb1" id="gdb1">gdb(1)</a></h1>
<h1><a class="header" href="#cli" id="cli">CLI</a></h1>
<pre><code class="language-markdown"> gdb [opts] [prg [-c coredump | -p pid]]
gdb [opts] --args prg <prg-args>
opts:
-p <pid> attach to pid
-c <coredump> use <coredump>
-x <file> execute script <file> before prompt
-ex <cmd> execute command <cmd> before prompt
--tty <tty> set I/O tty for debugee
</code></pre>
<h1><a class="header" href="#interactive-usage" id="interactive-usage">Interactive usage</a></h1>
<pre><code class="language-markdown"> tty <tty>
Set <tty> as tty for debugee.
Make sure nobody reads from target tty, easiest is to spawn a shell
and run following in target tty:
> while true; do sleep 1024; done
set follow-fork-mode <child | parent>
Specify which process to follow when debuggee makes a fork(2)
syscall.
sharedlibrary [<regex>]
Load symbols of shared libs loaded by debugee. Optionally use <regex>
to filter libs for symbol loading.
break [-qualified] <sym> thread <tnum>
Set a breakpoint only for a specific thread.
-qualified: Tred <sym> as fully qualified symbol (quiet handy to set
breakpoints on C symbols in C++ contexts)
rbreak <regex>
Set breakpoints matching <regex>, where matching internally is done
on: .*<regex>.*
command [<bp_list>]
Define commands to run after breakpoint hit. If <bp_list> is not
specified attach command to last created breakpoint. Command block
terminated with 'end' token.
<bp_list>: Space separates list, eg 'command 2 5-8' to run command
for breakpoints: 2,5,6,7,8.
info functions [<regex>]
List functions matching <regex>. List all functions if no <regex>
provided.
info variables [<regex>]
List variables matching <regex>. List all variables if no <regex>
provided.
info handle [<signal>]
Print how to handle <signal>. If no <signal> specified print for all
signals.
handle <signal> <action>
Configure how gdb handles <signal> sent to debugee.
<action>:
stop/nostop Catch signal in gdb and break.
print/noprint Print message when gdb catches signal.
pass/nopass Pass signal down to debugee.
catch signal <signal>
Create a catchpoint for <signal>.
</code></pre>
<h1><a class="header" href="#user-commands-macros" id="user-commands-macros">User commands (macros)</a></h1>
<p>Gdb allows to create & document user commands as follows:</p>
<pre><code class="language-markdown"> define <cmd>
# cmds
end
document <cmd>
# docu
end
</code></pre>
<p>To get all user commands or documentations one can use:</p>
<pre><code class="language-markdown"> help user-defined
help <cmd>
</code></pre>
<h1><a class="header" href="#hooks" id="hooks">Hooks</a></h1>
<p>Gdb allows to create two types of command <code>hooks</code></p>
<ul>
<li><code>hook-</code> will be run before <code><cmd></code></li>
<li><code>hookpost-</code> will be run after <code><cmd></code></li>
</ul>
<pre><code class="language-markdown"> define hook-<cmd>
# cmds
end
define hookpost-<cmd>
# cmds
end
</code></pre>
<h1><a class="header" href="#examples-1" id="examples-1">Examples</a></h1>
<h2><a class="header" href="#catch-sigsegv-and-execute-commands" id="catch-sigsegv-and-execute-commands">Catch SIGSEGV and execute commands</a></h2>
<p>This creates a <code>catchpoint</code> for the <code>SIGSEGV</code> signal and attached the <code>command</code>
to it.</p>
<pre><code class="language-markdown"> catch signal SIGSEGV
command
bt
c
end
</code></pre>
<h2><a class="header" href="#run-backtrace-on-thread-1-batch-mode" id="run-backtrace-on-thread-1-batch-mode">Run <code>backtrace</code> on thread 1 (batch mode)</a></h2>
<pre><code class="language-markdown"> gdb --batch -ex 'thread 1' -ex 'bt' -p <pid>
</code></pre>
<h2><a class="header" href="#script-gdb-for-automating-debugging-sessions" id="script-gdb-for-automating-debugging-sessions">Script gdb for automating debugging sessions</a></h2>
<p>To script gdb add commands into a file and pass it to gdb via <code>-x</code>.
For example create <code>run.gdb</code>:</p>
<pre><code class="language-markdown"> set pagination off
break mmap
command
info reg rdi rsi rdx
bt
c
end
#initial drop
c
</code></pre>
<p>This script can be used as:</p>
<pre><code class="language-markdown"> gdb --batch -x ./run.gdb -p <pid>
</code></pre>
<h1><a class="header" href="#know-bugs" id="know-bugs">Know Bugs</a></h1>
<h2><a class="header" href="#workaround-command--finish-bug" id="workaround-command--finish-bug">Workaround <code>command + finish</code> bug</a></h2>
<p>When using <code>finish</code> inside a <code>command</code> block, commands after <code>finish</code> are not
executed. To workaround that bug one can create a wrapper function which calls
<code>finish</code>.</p>
<pre><code class="language-markdown"> define handler
bt
finish
info reg rax
end
command
handler
end
</code></pre>
<h1><a class="header" href="#radare21" id="radare21">radare2(1)</a></h1>
<h2><a class="header" href="#print" id="print">print</a></h2>
<pre><code class="language-markdown">
pd <n> [@ <addr>] # print disassembly for <n> instructions
# with optional temporary seek to <addr>
</code></pre>
<h2><a class="header" href="#flags" id="flags">flags</a></h2>
<pre><code class="language-markdown"> fs # list flag-spaces
fs <fs> # select flag-space <fs>
f # print flags of selected flag-space
</code></pre>
<h2><a class="header" href="#help-1" id="help-1">help</a></h2>
<pre><code class="language-markdown"> ?*~<kw> # '?*' list all commands and '~' grep for <kw>
?*~... # '..' less mode /'...' interactive search
</code></pre>
<h2><a class="header" href="#relocation" id="relocation">relocation</a></h2>
<pre><code class="language-markdown"> > r2 -B <baddr> <exe> # open <exe> mapped to addr <baddr>
oob <addr> # reopen current file at <baddr>
</code></pre>
<h1><a class="header" href="#resource-analysis--monitor" id="resource-analysis--monitor">Resource analysis & monitor</a></h1>
<ul>
<li><a href="monitor/./lsof.html">lsof</a></li>
<li><a href="monitor/./pidstat.html">pidstat</a></li>
<li><a href="monitor/./pgrep.html">pgrep</a></li>
<li><a href="monitor/./pmap.html">pmap</a></li>
<li><a href="monitor/./pstack.html">pstack</a></li>
</ul>
<h1><a class="header" href="#lsof8" id="lsof8">lsof(8)</a></h1>
<pre><code class="language-markdown">lsof
-a ......... AND slection filters instead ORing (OR: default)
-p <pid> ... filter by <pid>
+fg ........ show file flags for file descripros
-n ......... don't convert network addr to hostnames
-P ......... don't convert network port to service names
-i <@h[:p]>. show connections to h (hostname|ip addr) with optional port p
</code></pre>
<pre><code class="language-markdown">file flags:
R/W/RW ..... read/write/read-write
CR ......... create
AP ......... append
TR ......... truncate
</code></pre>
<h1><a class="header" href="#examples-2" id="examples-2">Examples</a></h1>
<h2><a class="header" href="#file-flags" id="file-flags">File flags</a></h2>
<p>Show open files with file flags for process:</p>
<pre><code class="language-markdown">lsof +fg -p <pid>
</code></pre>
<h2><a class="header" href="#open-tcp-connections" id="open-tcp-connections">Open TCP connections</a></h2>
<p>Show open tcp connections for <code>$USER</code>:</p>
<pre><code class="language-markdown">lsof -a -u $USER -i tcp
</code></pre>
<p><strong>Note</strong>: <code>-a</code> <em>ands</em> the results. If <code>-a</code> is not given all open files matching
<code>$USER</code> and all tcp connections are listed (<em>ored</em>).</p>
<h2><a class="header" href="#open-connection-to-specific-host" id="open-connection-to-specific-host">Open connection to specific host</a></h2>
<p>Show open connections to <code>localhost</code> for <code>$USER</code>:</p>
<pre><code class="language-markdown">lsof -a -u $USER -i @localhost
</code></pre>
<h1><a class="header" href="#pidstat1" id="pidstat1">pidstat(1)</a></h1>
<pre><code class="language-markdown">pidstat [opt] [interval] [cont]
-U [user] show username instead UID, optionally only show for user
-r memory statistics
-d I/O statistics
-h single line per process and no lines with average
</code></pre>
<h1><a class="header" href="#page-fault-and-memory-utilization" id="page-fault-and-memory-utilization">Page fault and memory utilization</a></h1>
<pre><code class="language-markdown">pidstat -r -p <pid> [interval] [count]
</code></pre>
<pre><code class="language-markdown">minor_pagefault: Happens when the page needed is already in memory but not
allocated to the faulting process, in that case the kernel
only has to create a new page-table entry pointing to the
shared physical page (not required to load a memory page from
disk).
major_pagefault: Happens when the page needed is NOT in memory, the kernel
has to create a new page-table entry and populate the
physical page (required to load a memory page from disk).
</code></pre>
<h1><a class="header" href="#io-statistics" id="io-statistics">I/O statistics</a></h1>
<pre><code class="language-markdown">pidstat -d -p <pid> [interval] [count]
</code></pre>
<h1><a class="header" href="#pgrep1" id="pgrep1">pgrep(1)</a></h1>
<pre><code class="language-markdown">pgrep [opts] <pattern>
-n only list newest matching process
-u <usr> only show matching for user <usr>
-l additionally list command
-a additionally list command + arguments
</code></pre>
<h2><a class="header" href="#debug-newest-process" id="debug-newest-process">Debug newest process</a></h2>
<p>For example attach gdb to newest zsh process from <code>$USER</code>.</p>
<pre><code class="language-markdown">gdb -p $(pgrep -n -u $USER zsh)
</code></pre>
<h1><a class="header" href="#pmap1" id="pmap1">pmap(1)</a></h1>
<pre><code class="language-markdown">pmap <pid>
Dump virtual memory map of process.
Compared to /proc/<pid>/maps it shows the size of the mappings.
</code></pre>
<h1><a class="header" href="#pstack1" id="pstack1">pstack(1)</a></h1>
<pre><code class="language-markdown">pstack <pid>
Dump stack for all threads of process.
</code></pre>
<h1><a class="header" href="#trace-and-profile" id="trace-and-profile">Trace and Profile</a></h1>
<ul>
<li><a href="trace_profile/./strace.html">strace</a></li>
<li><a href="trace_profile/./ltrace.html">ltrace</a></li>
<li><a href="trace_profile/./perf.html">perf</a></li>
<li><a href="trace_profile/./oprofile.html">OProfile</a></li>
<li><a href="trace_profile/./time.html">time</a></li>
</ul>
<h1><a class="header" href="#strace1" id="strace1">strace(1)</a></h1>
<pre><code class="language-markdown">strace [opts] [prg]
-f .......... follow child processes on fork(2)
-p <pid> .... attach to running process
-s <size> ... max string size, truncate of longer (default: 32)
-e <expr> ... expression for trace filtering
-o <file> ... log output into <file>
-c .......... dump syscall statitics at the end
</code></pre>
<pre><code class="language-markdown"><expr>:
trace=syscall[,syscall] .... trace only syscall listed
trace=file ................. trace all syscall that take a filename as arg
trace=process .............. trace process management related syscalls
trace=signal ............... trace signal related syscalls
signal ..................... trace signals delivered to the process
</code></pre>
<h1><a class="header" href="#examples-3" id="examples-3">Examples</a></h1>
<p>Trace <code>open(2)</code> & <code>socket(2)</code> syscalls for a running process + child processes:</p>
<pre><code class="language-markdown">strace -f -e trace=open,socket -p <pid>
</code></pre>
<p>Trace signals delivered to a running process:</p>
<pre><code class="language-markdown">strace -f -e signal -p <pid>
</code></pre>
<h1><a class="header" href="#ltrace1" id="ltrace1">ltrace(1)</a></h1>
<pre><code class="language-markdown">ltrace [opts] [prg]
-f .......... follow child processes on fork(2)
-p <pid> .... attach to running process
-o <file> ... log output into <file>
-l <filter> . show who calls into lib matched by <filter>
-C .......... demangle
</code></pre>
<h1><a class="header" href="#example-2" id="example-2">Example</a></h1>
<p>List which program/libs call into <code>libstdc++</code>:</p>
<pre><code class="language-bash">ltrace -l '*libstdc++*' -C -o ltrace.log ./main
</code></pre>
<h1><a class="header" href="#perf1" id="perf1">perf(1)</a></h1>
<pre><code class="language-markdown">perf list show supported hw/sw events
perf stat
-p <pid> .. show stats for running process
-I <ms> ... show stats periodically over interval <ms>
-e <ev> ... filter for events
perf top
-p <pid> .. show stats for running process
-F <hz> ... sampling frequency
-K ........ hide kernel threads
perf record
-p <pid> ............... record stats for running process
-F <hz> ................ sampling frequency
--call-graph <method> .. [fp, dwarf, lbr] method how to caputre backtrace
fp : use frame-pointer, need to compile with
-fno-omit-frame-pointer
dwarf: use .cfi debug information
lbr : use hardware last branch record facility
-g ..................... short-hand for --call-graph fp
-e <ev> ................ filter for events
perf report
-n .................... annotate symbols with nr of samples
--stdio ............... report to stdio, if not presen tui mode
-g graph,0.5,caller ... show caller based call chains with value >0.5
</code></pre>
<pre><code class="language-markdown">Useful <ev>:
page-faults
minor-faults
major-faults
cpu-cycles`
task-clock
</code></pre>
<h2><a class="header" href="#a-hrefhttpsgithubcombrendangreggflamegraphflamegrapha" id="a-hrefhttpsgithubcombrendangreggflamegraphflamegrapha"><a href="https://github.com/brendangregg/FlameGraph"><code>Flamegraph</code></a></a></h2>
<h3><a class="header" href="#flamegraph-with-single-event-trace" id="flamegraph-with-single-event-trace">Flamegraph with single event trace</a></h3>
<pre><code class="language-markdown">perf record -g -e cpu-cycles -p <pid>
perf script | FlameGraph/stackcollapse-perf.pl | FlameGraph/flamegraph.pl > cycles-flamegraph.svg
</code></pre>
<h3><a class="header" href="#flamegraph-with-multiple-event-traces" id="flamegraph-with-multiple-event-traces">Flamegraph with multiple event traces</a></h3>
<pre><code class="language-markdown">perf record -g -e cpu-cycles,page-faults -p <pid>
perf script --per-event-dump
# fold & generate as above
</code></pre>
<h1><a class="header" href="#a-hrefhttpsoprofilesourceforgeiooprofilea" id="a-hrefhttpsoprofilesourceforgeiooprofilea"><a href="https://oprofile.sourceforge.io/">OProfile</a></a></h1>
<pre><code class="language-markdown">operf -g -p <pid>
-g ...... caputre call-graph information
opreport [opt] FILE
show time spent per binary image
-l ...... show time spent per symbol
-c ...... show callgraph information (see below)
-a ...... add column with time spent accumulated over child nodes
ophelp show supported hw/sw events
</code></pre>
<h1><a class="header" href="#usrbintime1" id="usrbintime1">/usr/bin/time(1)</a></h1>
<pre><code class="language-markdown"># statistics of process run
/usr/bin/time -v <cmd>
</code></pre>
<h1><a class="header" href="#binary" id="binary">Binary</a></h1>
<ul>
<li><a href="binary/./od.html">od</a></li>
<li><a href="binary/./xxd.html">xxd</a></li>
<li><a href="binary/./readelf.html">readelf</a></li>
<li><a href="binary/./objdump.html">objdump</a></li>
<li><a href="binary/./nm.html">nm</a></li>
</ul>
<h1><a class="header" href="#od1" id="od1">od(1)</a></h1>
<pre><code class="language-markdown"> od [opts] <file>
-An don't print addr info
-tx4 print hex in 4 byte chunks
-ta print as named character
-tc printable chars or backslash escape
-w4 print 4 bytes per line
-j <n> skip <n> bytes from <file> (hex if start with 0x)
-N <n> dump <n> bytes (hex of start with 0x)
</code></pre>
<h2><a class="header" href="#ascii-to-hex-string" id="ascii-to-hex-string">ASCII to hex string</a></h2>
<pre><code class="language-markdown"> echo -n AAAABBBB | od -An -w4 -tx4
>> 41414141
>> 42424242
echo -n '\x7fELF\n' | od -tx1 -ta -tc
>> 0000000 7f 45 4c 46 0a # tx1
>> del E L F nl # ta
>> 177 E L F \n # tc
</code></pre>
<h2><a class="header" href="#extract-parts-of-file" id="extract-parts-of-file">Extract parts of file</a></h2>
<p>For example <code>.rodata</code> section from an elf file. We can use <code>readelf</code> to get the
offset into the file where the <code>.rodata</code> section starts.</p>
<pre><code class="language-markdown"> readelf -W -S foo
>> Section Headers:
>> [Nr] Name Type Address Off Size ES Flg Lk Inf Al
>> ...
>> [15] .rodata PROGBITS 00000000004009c0 0009c0 000030 00 A 0 0 16
</code></pre>
<p>With the offset of <code>-j 0x0009c0</code> we can dump <code>-N 0x30</code> bytes from the beginning of
the <code>.rodata</code> section as follows:</p>
<pre><code class="language-markdown"> od -j 0x0009c0 -N 0x30 -tx4 -w4 foo
>> 0004700 00020001
>> 0004704 00000000
>> *
>> 0004740 00000001
>> 0004744 00000002
>> 0004750 00000003
>> 0004754 00000004
</code></pre>
<p><strong>Note</strong>: Numbers starting with <code>0x</code> will be interpreted as hex by <code>od</code>.</p>
<h1><a class="header" href="#xxd1" id="xxd1">xxd(1)</a></h1>
<pre><code class="language-markdown"> xxd [opts]
-p dump continuous hexdump
-r convert hexdump into binary ('revert')
-e dump as little endian mode
-i output as C array
</code></pre>
<h2><a class="header" href="#ascii-to-hex-stream" id="ascii-to-hex-stream">ASCII to hex stream</a></h2>
<pre><code class="language-markdown"> echo -n 'aabb' | xxd -p
>> 61616262
</code></pre>
<h2><a class="header" href="#hex-to-binary-stream" id="hex-to-binary-stream">Hex to binary stream</a></h2>
<pre><code class="language-markdown"> echo -n '61616262' | xxd -p -r
>> aabb
</code></pre>
<h2><a class="header" href="#ascii-to-binary" id="ascii-to-binary">ASCII to binary</a></h2>
<pre><code class="language-markdown"> echo -n '\x7fELF' | xxd -p | xxd -p -r | file -p -
>> ELF
</code></pre>
<h2><a class="header" href="#ascii-to-c-array-hex-encoded" id="ascii-to-c-array-hex-encoded">ASCII to <code>C</code> array (hex encoded)</a></h2>
<pre><code class="language-markdown"> xxd -i <(echo -n '\x7fELF')
>> unsigned char _proc_self_fd_11[] = {
>> 0x7f, 0x45, 0x4c, 0x46
>> };
>> unsigned int _proc_self_fd_11_len = 4;
</code></pre>
<h1><a class="header" href="#readelf1" id="readelf1">readelf(1)</a></h1>
<pre><code class="language-markdown"> readelf [opts] <elf>
-W|--wide wide output, dont break output at 80 chars
-h print ELF header
-S print section headers
-l print program headers + segment mapping
-d print .dynamic section (dynamic link information)
--syms print symbol tables (.symtab .dynsym)
--dyn-syms print dynamic symbol table (exported symbols for dynamic linker)
-r print relocation sections (.rel.*, .rela.*)
</code></pre>
<h1><a class="header" href="#objdump1" id="objdump1">objdump(1)</a></h1>
<pre><code class="language-markdown"> objdump [opts] <elf>
-M intel use intil syntax
-d disassemble text section
-D disassemble all sections
-S mix disassembly with source code
-C demangle
-j <section> display info for section
--[no-]show-raw-insn [dont] show object code next to disassembly
</code></pre>
<h2><a class="header" href="#disassemble-section" id="disassemble-section">Disassemble section</a></h2>
<p>For example <code>.plt</code> section:</p>
<pre><code class="language-markdown"> objdump -j .plt -d <elf>
</code></pre>
<h1><a class="header" href="#nm1" id="nm1">nm(1)</a></h1>
<pre><code class="language-markdown"> nm [opts] <elf>
-C demangle
-u undefined only
</code></pre>
<h1><a class="header" href="#development" id="development">Development</a></h1>
<ul>
<li><a href="development/./c++filt.html">c++filt</a></li>
<li><a href="development/./c++.html">c++</a></li>
<li><a href="development/./glibc.html">glibc</a></li>
<li><a href="development/./gcc.html">gcc</a></li>
<li><a href="development/./ld.so.html">ld.so</a></li>
</ul>
<h1><a class="header" href="#cfilt1" id="cfilt1">c++filt(1)</a></h1>
<h2><a class="header" href="#demangle-symbol" id="demangle-symbol">Demangle symbol</a></h2>
<pre><code class="language-markdown"> c++-filt <symbol_str>
</code></pre>
<h2><a class="header" href="#demangle-stream" id="demangle-stream">Demangle stream</a></h2>
<p>For example dynamic symbol table:</p>
<pre><code class="language-markdown"> readelf -W --dyn-syms <elf> | c++filt
</code></pre>
<h1><a class="header" href="#c" id="c">c++</a></h1>
<h2><a class="header" href="#type-deduction" id="type-deduction">Type deduction</a></h2>
<p>Force compile error to see what <code>auto</code> is deduced to.</p>
<pre><code class="language-cpp">auto foo = bar();
// force compile error
typename decltype(foo)::_;
</code></pre>
<h1><a class="header" href="#glibc" id="glibc">glibc</a></h1>
<h2><a class="header" href="#malloc-tracer-a-hrefhttpman7orglinuxman-pagesman3mtrace3htmlmtrace3a" id="malloc-tracer-a-hrefhttpman7orglinuxman-pagesman3mtrace3htmlmtrace3a">malloc tracer <a href="http://man7.org/linux/man-pages/man3/mtrace.3.html"><code>mtrace(3)</code></a></a></h2>
<p>Trace memory allocation and de-allocation to detect memory leaks.
Need to call <code>mtrace(3)</code> to install the tracing hooks.</p>
<p>If we can't modify the binary to call <code>mtrace</code> we can create a small shared
library and pre-load it.</p>
<pre><code class="language-c">// libmtrace.c
#include <mcheck.h>
__attribute__((constructor)) static void init_mtrace() { mtrace(); }
</code></pre>
<p>Compile as:</p>
<pre><code class="language-bash">gcc -shared -fPIC -o libmtrace.so libmtrace.c
</code></pre>
<p>To generate the trace file run:</p>
<pre><code class="language-bash">export MALLOC_TRACE=<file>
LD_PRELOAD=./libmtrace.so <binary>
</code></pre>
<p><strong>Note</strong>: If <code>MALLOC_TRACE</code> is not set <code>mtrace</code> won't install tracing hooks.</p>
<p>To get the results of the trace file:</p>
<pre><code class="language-bash">mtrace <binary> $MALLOC_TRACE
</code></pre>
<h2><a class="header" href="#malloc-check-a-hrefhttpman7orglinuxman-pagesman3mallopt3htmlmallopt3a" id="malloc-check-a-hrefhttpman7orglinuxman-pagesman3mallopt3htmlmallopt3a">malloc check <a href="http://man7.org/linux/man-pages/man3/mallopt.3.html"><code>mallopt(3)</code></a></a></h2>
<p>Configure action when glibc detects memory error.</p>
<pre><code class="language-bash">export MALLOC_CHECK_=<N>
</code></pre>
<p>Useful values:</p>
<pre><code class="language-markdown">1 print detailed error & continue
3 print detailed error + stack trace + memory mappings & abort
7 print simple error message + stack trace + memory mappings & abort
</code></pre>
<h1><a class="header" href="#gcc1" id="gcc1">gcc(1)</a></h1>
<h2><a class="header" href="#cli-1" id="cli-1">CLI</a></h2>
<h3><a class="header" href="#preprocessing" id="preprocessing">Preprocessing</a></h3>
<p>While debugging can be helpful to just pre-process files.</p>
<pre><code class="language-bash">gcc -E [-dM] ...
</code></pre>
<ul>
<li><code>-E</code> run only preprocessor</li>
<li><code>-dM</code> list only <code>#define</code> statements</li>
</ul>
<h2><a class="header" href="#a-hrefhttpsgccgnuorgonlinedocsgccother-builtinshtmlbuiltinsa" id="a-hrefhttpsgccgnuorgonlinedocsgccother-builtinshtmlbuiltinsa"><a href="https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html">Builtins</a></a></h2>
<h3><a class="header" href="#__builtin_expectexpr-cond" id="__builtin_expectexpr-cond"><code>__builtin_expect(expr, cond)</code></a></h3>
<p>Give the compiler a hint which branch is hot, so it can lay out the code
accordingly to reduce number of jump instructions.
See on <a href="https://godbolt.org/z/MbTHAP">compiler explorer</a>.</p>
<pre><code class="language-bash">echo "
extern void foo();
extern void bar();
void run0(int x) {
if (__builtin_expect(x,0)) { foo(); }
else { bar(); }
}
void run1(int x) {
if (__builtin_expect(x,1)) { foo(); }
else { bar(); }
}
" | gcc -O2 -S -masm=intel -o /dev/stdout -xc -
</code></pre>
<p>Will generate something similar to the following.</p>
<ul>
<li><code>run0</code>: <code>bar</code> is on the path without branch</li>
<li><code>run1</code>: <code>foo</code> is on the path without branch</li>
</ul>
<pre><code class="language-c">run0:
test edi, edi
jne .L4
xor eax, eax
jmp bar
.L4:
xor eax, eax
jmp foo
run1:
test edi, edi
je .L6
xor eax, eax
jmp foo
.L6:
xor eax, eax
jmp bar
</code></pre>
<h1><a class="header" href="#ldso8" id="ldso8">ld.so(8)</a></h1>
<h2><a class="header" href="#environment-variables" id="environment-variables">Environment Variables</a></h2>
<pre><code class="language-console"> LD_PRELOAD=<l_so> colon separated list of libso's to be pre loaded
LD_DEBUG=<opts> comma separated list of debug options
=help list available options
=libs show library search path
=files processing of input files
=symbols show search path for symbol lookup
=bindings show against which definition a symbol is bound
</code></pre>
<h2><a class="header" href="#ld_preload-initialization-order-and-link-map" id="ld_preload-initialization-order-and-link-map">LD_PRELOAD: Initialization Order and Link Map</a></h2>
<p>Libraries specified in <code>LD_PRELOAD</code> are loaded from <code>left-to-right</code> but
initialized from <code>right-to-left</code>.</p>
<pre><code class="language-markdown"> > ldd ./main
>> libc.so.6 => /usr/lib/libc.so.6
> LD_PRELOAD=liba.so:libb.so ./main
-->
preloaded in this order
<--
initialized in this order
</code></pre>
<p>The preload order determines:</p>
<ul>
<li>the order libraries are inserted into the <code>link map</code></li>
<li>the initialization order for libraries</li>
</ul>
<p>For the example listed above the resulting <code>link map</code> will look like the
following:</p>
<pre><code class="language-makrdown"> +------+ +------+ +------+ +------+
| main | -> | liba | -> | libb | -> | libc |
+------+ +------+ +------+ +------+
</code></pre>
<p>This can be seen when running with <code>LD_DEBUG=files</code>:</p>
<pre><code class="language-makrdown"> > LD_DEBUG=files LD_PRELOAD=liba.so:libb.so ./main
# load order (-> determines link map)
>> file=liba.so [0]; generating link map
>> file=libb.so [0]; generating link map
>> file=libc.so.6 [0]; generating link map
# init order
>> calling init: /usr/lib/libc.so.6
>> calling init: <path>/libb.so
>> calling init: <path>/liba.so
>> initialize program: ./main
</code></pre>
<p>To verify the <code>link map</code> order we let <code>ld.so</code> resolve the <code>memcpy(3)</code> libc
symbol (used in <em>main</em>) dynamically, while enabling <code>LD_DEBUG=symbols,bindings</code>
to see the resolving in action.</p>
<pre><code class="language-makrdown"> > LD_DEBUG=symbols,bindings LD_PRELOAD=liba.so:libb.so ./main
>> symbol=memcpy; lookup in file=./main [0]
>> symbol=memcpy; lookup in file=<path>/liba.so [0]
>> symbol=memcpy; lookup in file=<path>/libb.so [0]
>> symbol=memcpy; lookup in file=/usr/lib/libc.so.6 [0]
>> binding file ./main [0] to /usr/lib/libc.so.6 [0]: normal symbol `memcpy' [GLIBC_2.14]
</code></pre>
<h2><a class="header" href="#dynamic-linking-x86_64" id="dynamic-linking-x86_64">Dynamic Linking (x86_64)</a></h2>
<p>Dynamic linking basically works via one indirect jump. It uses a combination of
function trampolines (<code>.plt</code> section) and a function pointer table (<code>.got.plt</code>
section).
On the first call the trampoline sets up some metadata and then jumps to the
<code>ld.so</code> runtime resolve function, which in turn patches the table with the
correct function pointer.</p>
<pre><code class="language-makrdown"> .plt ....... procedure linkage table, contains function trampolines, usually
located in code segment (rx permission)
.got.plt ... global offset table for .plt, holds the function pointer table
</code></pre>
<p>Using <code>radare2</code> we can analyze this in more detail:</p>
<pre><code class="language-makrdown"> [0x00401040]> pd 4 @ section..got.plt
;-- section..got.plt:
;-- .got.plt: ; [22] -rw- section size 32 named .got.plt
;-- _GLOBAL_OFFSET_TABLE_:
[0] 0x00404000 .qword 0x0000000000403e10 ; section..dynamic
[1] 0x00404008 .qword 0x0000000000000000
; CODE XREF from section..plt @ +0x6
[2] 0x00404010 .qword 0x0000000000000000
;-- reloc.puts:
; CODE XREF from sym.imp.puts @ 0x401030
[3] 0x00404018 .qword 0x0000000000401036 ; RELOC 64 puts
[0x00401040]> pd 6 @ section..plt
;-- section..plt:
;-- .plt: ; [12] -r-x section size 32 named .plt
┌─> 0x00401020 ff35e22f0000 push qword [0x00404008]
╎ 0x00401026 ff25e42f0000 jmp qword [0x00404010]
╎ 0x0040102c 0f1f4000 nop dword [rax]
┌ 6: int sym.imp.puts (const char *s);
└ ╎ 0x00401030 ff25e22f0000 jmp qword [reloc.puts]
╎ 0x00401036 6800000000 push 0
└─< 0x0040103b e9e0ffffff jmp sym..plt
</code></pre>
<ul>
<li>At address <code>0x00401030</code> in the <code>.plt</code> section we see the indirect jump for
<code>puts</code> using the function pointer in <code>_GLOBAL_OFFSET_TABLE_[3] (GOT)</code>.</li>
<li><code>GOT[3]</code> initially points to instruction after the <code>puts</code> trampoline
<code>0x00401036</code>.</li>
<li>This pushes the relocation index <code>0</code> and then jumps to the first trampoline
<code>0x00401020</code>.</li>
<li>The first trampoline jumps to <code>GOT[2]</code> which will be filled at program
startup by the <code>ld.so</code> with its resolve function.</li>
<li>The <code>ld.so</code> resolve function fixes the relocation referenced by the
relocation index pushed by the <code>puts</code> trampoline.</li>
<li>The relocation entry at index <code>0</code> tells the resolve function which symbol to
search for and where to put the function pointer:
<pre><code class="language-makrdown"> > readelf -r <main>
>> Relocation section '.rela.plt' at offset 0x4b8 contains 1 entry:
>> Offset Info Type Sym. Value Sym. Name + Addend
>> 000000404018 000200000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0
</code></pre>
As we can see the offset from relocation at index <code>0</code> points to <code>GOT[3]</code>.</li>
</ul>
<h1><a class="header" href="#arch" id="arch">Arch</a></h1>
<ul>
<li><a href="arch/./x86_64.html">x86_64</a></li>
</ul>
<h1><a class="header" href="#x86_64" id="x86_64">x86_64</a></h1>
<p>keywords: x86_64, x86, abi</p>
<ul>
<li>64bit synonyms: <code>x86_64</code>, <code>x64</code>, <code>amd64</code>, <code>intel 64</code></li>
<li>32bit synonyms: <code>x86</code>, <code>ia32</code>, <code>i386</code></li>
<li>ISA type: <code>CISC</code></li>
<li>Endianness: <code>little</code></li>
</ul>
<h2><a class="header" href="#registers" id="registers">Registers</a></h2>
<h3><a class="header" href="#general-purpose-register" id="general-purpose-register">General purpose register</a></h3>
<pre><code class="language-markdown">bytes
[7:0] [3:0] [1:0] [1] [0] desc
----------------------------------------------------------
rax eax ax ah al accumulator
rbx ebx bx bh bl base register
rcx ecx cx ch cl counter
rdx edx dx dh dl data register
rsi esi si - sil source index
rdi edi di - dil destination index
rbp ebp bp - bpl base pointer
rsp esp sp - spl stack pointer
r8-15 rNd rNw - rNb
</code></pre>
<h3><a class="header" href="#special-register" id="special-register">Special register</a></h3>
<pre><code class="language-markdown">bytes
[7:0] [3:0] [1:0] desc
---------------------------------------------------
rflags eflags flags flags register
rip eip ip instruction pointer
</code></pre>
<h3><a class="header" href="#flags-register" id="flags-register">FLAGS register</a></h3>
<pre><code class="language-markdown">rflags
bits desc
-----------------------------
[11] OF overflow flag
[10] DF direction flag
[7] SF sign flag
[6] ZF zero flag
[4] AF auxiliary carry flag
[2] PF parity flag
[0] CF carry flag
</code></pre>
<h2><a class="header" href="#addressing" id="addressing">Addressing</a></h2>
<pre><code class="language-asm">movw [rax], rbx // save val in rbx at [rax]
movw [imm], rbx // save val in rbx at [imm]
movw rax, [rbx+4*rcx] // load val at [rbx+4*rcx] into rax
</code></pre>
<p><code>rip</code> relative addressing:</p>
<pre><code class="language-asm">lea rax, [rip+.my_str] // load addr of .my_str into rax
...
.my_str:
.asciz "Foo"
</code></pre>
<h2><a class="header" href="#size-directives" id="size-directives">Size directives</a></h2>
<p>Explicitly specify size of the operation.</p>
<pre><code class="language-nasm">mov byte ptr [rax], 0xff // save 1 byte(s) at [rax]
mov word ptr [rax], 0xff // save 2 byte(s) at [rax]
mov dword ptr [rax], 0xff // save 4 byte(s) at [rax]
mov qword ptr [rax], 0xff // save 8 byte(s) at [rax]
</code></pre>
<h2><a class="header" href="#a-hrefhttpswwwuclibcorgdocspsabi-x86_64pdfsysv-x86_64-abia" id="a-hrefhttpswwwuclibcorgdocspsabi-x86_64pdfsysv-x86_64-abia"><a href="https://www.uclibc.org/docs/psABI-x86_64.pdf">SysV x86_64 ABI</a></a></h2>
<h3><a class="header" href="#passing-arguments-to-functions" id="passing-arguments-to-functions">Passing arguments to functions</a></h3>
<ul>
<li>Integer/Pointer arguments
<pre><code class="language-markdown">reg arg
-----------
rdi 1
rsi 2
rdx 3
rcx 4
r8 5
r9 6
</code></pre>
</li>
<li>Floating point arguments
<pre><code class="language-markdown">reg arg
-----------
xmm0 1
.. ..
xmm7 7
</code></pre>
</li>
<li>Additional arguments are passed on the stack. Arguments are pushed
right-to-left (RTL), meaning next arguments are closer to current <code>rsp</code>.</li>
</ul>
<h3><a class="header" href="#return-values-from-functions" id="return-values-from-functions">Return values from functions</a></h3>
<ul>
<li>Integer/Pointer return values
<pre><code class="language-markdown">reg size
-----------------
rax 64 bit
rax+rdx 128 bit
</code></pre>
</li>
<li>Floating point return values:
<pre><code class="language-markdown">reg size
-------------------
xmm0 64 bit
xmm0+xmm1 128 bit
</code></pre>
</li>
</ul>
<h3><a class="header" href="#caller-saved-registers" id="caller-saved-registers">Caller saved registers</a></h3>
<p>Caller must save these registers if they should be preserved across function
calls.</p>
<ul>
<li><code>rax</code></li>
<li><code>rcx</code></li>
<li><code>rdx</code></li>
<li><code>rsi</code></li>
<li><code>rdi</code></li>
<li><code>rsp</code></li>
<li><code>r8</code> - <code>r11</code></li>
</ul>
<h3><a class="header" href="#callee-saved-registers" id="callee-saved-registers">Callee saved registers</a></h3>
<p>Caller can expect these registers to be preserved across function calls. Callee
must must save these registers in case they are used.</p>
<ul>
<li><code>rbx</code></li>
<li><code>rbp</code></li>
<li><code>r12</code> – <code>r15</code></li>
</ul>
<h3><a class="header" href="#stack" id="stack">Stack</a></h3>
<ul>
<li>grows downwards</li>
<li>frames aligned on 16 byte boundary
<pre><code class="language-text">HI ADDR
| +------------+
| | prev frame |
| +------------+ <--- 16 byte aligned (X & ~0xf)
| [rbp+8] | saved RIP |
| [rbp] | saved RBP |
| [rbp-8] | func stack |
| | ... |
v +------------+
LO ADDR
</code></pre>
</li>
</ul>
<h2><a class="header" href="#references" id="references">References</a></h2>
<ul>
<li><a href="https://www.uclibc.org/docs/psABI-x86_64.pdf">SystemV AMD64 ABI</a></li>
<li><a href="https://www.amd.com/system/files/TechDocs/24592.pdf">AMD64 Vol1: Application Programming</a></li>
<li><a href="https://www.amd.com/system/files/TechDocs/24593.pdf">AMD64 Vol2: System Programming</a></li>
<li><a href="https://www.amd.com/system/files/TechDocs/24594.pdf">AMD64 Vol3: General-Purpose & System Instructions</a></li>
<li><a href="https://cs.brown.edu/courses/cs033/docs/guides/x64_cheatsheet.pdf">X86_64 Cheat-Sheet</a></li>
<li><a href="https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-software-developers-manual-volume-1-basic-architecture.html">Intel 64 Vol1: Basic Architecture</a></li>
<li><a href="https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-sdm-combined-volumes-2a-2b-2c-and-2d-instruction-set-reference-a-z.html">Intel 64 Vol2: Instruction Set Reference</a></li>
<li><a href="https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-sdm-combined-volumes-3a-3b-3c-and-3d-system-programming-guide.html">Intel 64 Vol3: System Programming Guide</a></li>
</ul>
</main>
<nav class="nav-wrapper" aria-label="Page navigation">
<!-- Mobile navigation buttons -->
<div style="clear: both"></div>
</nav>
</div>
</div>
<nav class="nav-wide-wrapper" aria-label="Page navigation">
</nav>
</div>
<script type="text/javascript">
window.playpen_copyable = true;
</script>
<script src="elasticlunr.min.js" type="text/javascript" charset="utf-8"></script>
<script src="mark.min.js" type="text/javascript" charset="utf-8"></script>
<script src="searcher.js" type="text/javascript" charset="utf-8"></script>
<script src="clipboard.min.js" type="text/javascript" charset="utf-8"></script>
<script src="highlight.js" type="text/javascript" charset="utf-8"></script>
<script src="book.js" type="text/javascript" charset="utf-8"></script>
<!-- Custom JS scripts -->
<script type="text/javascript">
window.addEventListener('load', function() {
window.setTimeout(window.print, 100);
});
</script>
</body>
</html>
