0

Assuming I have a syscall to open.

man 2 open gives me info, that it requires 2 or 3 parameters 

int open(const char *pathname, int flags);
int open(const char *pathname, int flags, mode_t mode);

So, my code runs and In my registers I have 

$rdi = 0x00007fffffffdb40 → "/etc/init.d/",
$rsi = 0x0000000000000241,
$rdx = 0x00000000000001c9

How and which flags is it using during the call? How will the dir (or file) be opened?

  1. I am looking at the man page. The possible flags are mentioned, but not their bit/value/integer being set by |'ing the flags together in source code.
  2. I continue at the man page and see above the header files, which define the constants. In this case I'd need to #include <sys/types.h> <sys/stat.h> <fcntl.h>. However, in this files, I cannot find bits or integers, which sum or | up to the given flags ($rsi = 0x241, 577 in decimal, 1001000001 in binary) I cannot see any pattern.

Question: Do I oversee something? Do I need to look somewhere else? Where are those bits described?

Joel
  • 125
  • 5
  • 1
    You cant. Flags are defined with preprocessor #define. So compiler will replace that definition with integer. Only enumerations and structures can shows values. – Biswapriyo Sep 15 '18 at 21:19

1 Answers1

4

The flags are constants drawn from here: https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h

They can change but very rarely.

Applying this we can see that

0x241 == O_WRONLY | O_CREAT | O_TRUNC

Abigail
  • 684
  • 3
  • 9
  • For me it is not obvious to get from O_CREAT 00000100 | O_WRONLY 00000001 | O_TRUNC 00001000 to 0x241 ? What number-system do they use in this header file? Do you maybe have a reference on how to read those numbers? – Joel Sep 16 '18 at 06:55
  • 2
    literals prefixed with 0 are octals, so 0100 is 64 or 0x40. 01000 is 0x200, 1 is 1, so we're 0x40 + 0x200 + 1 = 0x241. – Abigail Sep 16 '18 at 10:17
  • thanks, makes sense now. For everyone else might read this, here is additional info: https://stackoverflow.com/questions/37326133/why-fcntl-flag-values-are-defined-in-octal-format-how-this-function-works-fo – Joel Sep 16 '18 at 10:35