4

I've got the following strace output that I'm going through to teach myself a little more about the flow of programs. Here's the section that's confusing me:

16:08:02 open("/lib/libncurses.so.5", O_RDONLY) = 3 <0.000046>
16:08:02 read(3, "\x7f\"..., 512) = 512 <0.000048>
16:08:02 fstat64(3, {st_dev=makedev(202, 0), st_ino=16548, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=464, st_size=231576, st_atime=2011/02/06-15:37:43, st_mtime=2011/01/04-06:05:23, st_ctime=2011/02/06-15:37:43}) = 0 <0.000038>

What is gained by reading the first 512 bytes? It seems like this pattern is common with shared libraries.

UPDATE: I just got a great answer on that clarifies the 512 byte length. Specifically from a comment in elf/dl-load.c:

The ELF header 32-bit files is 52 bytes long and in 64-bit files is 64 bytes long. Each program header entry is again 32 and 56 bytes long respectively. I.e., even with a file which has 10 program header entries we only have to read 372B/624B respectively. Add to this a bit of margin for program notes and reading 512B and 832B for 32-bit and 64-bit files respecitvely is enough.

MLACitation
  • 43
  • 3

1 Answers1

6

The first 512 bytes contain the header which is needed to identify the file type, target platform, version, and so on. Once the header is read, the code then jumps to the handler for this particular type of file.

David Schwartz
  • 31,215
  • 2
  • 53
  • 82
  • Thank you. Where should I go to read more about this? Any good man pages for learning more? – MLACitation Aug 13 '12 at 14:10
  • I just got a great answer on that clarifies the 512 byte length (http://www.reddit.com/r/linuxquestions/comments/y56jl/strace_opens_reads_and_then_fstats_a_file_need/). Specifically from a comment in elf/dl-load.c: `The ELF header 32-bit files is 52 bytes long and in 64-bit files is 64 bytes long. Each program header entry is again 32 and 56 bytes long respectively. I.e., even with a file which has 10 program header entries we only have to read 372B/624B respectively. Add to this a bit of margin for program notes and reading 512B and 832B for 32-bit and 64-bit files respecitvely is enough.` – MLACitation Aug 13 '12 at 18:25