Linux内核--内核地址空间分布和进程地址空间
http://www.cnblogs.com/bizhu/archive/2012/10/09/2717303.html
内核地址空间分布
直接映射区：线性空间中从3G开始最大896M的区间，为直接内存映射区，该区域的线性地址和物理地址
存在线性转换关系：线性地址=3G+物理地址。
动态内存映射区:该区域由内核函数vmalloc来分配，特点是：线性空间连续，但是对应的物理空间不一
定连续。vmalloc分配的线性地址所对应的物理页可能处于低端内存，也可能处于高端内存。
永久内存映射区：该区域可访问高端内存。访问方法是使用alloc_page(_GFP_HIGHMEM)分配高端内存页
或者使用kmap函数将分配到的高端内存映射到该区域。
固定映射区：该区域和4G的顶端只有4k的隔离带，其每个地址项都服务于特定的用途，如ACPI_BASE等。
进程的地址空间
linux采用虚拟内存管理技术，每一个进程都有一个3G大小的独立的进程地址空间，这个地址空间就
是用户空间。每个进程的用户空间都是完全独立、互不相干的。进程访问内核空间的方式：系统调用和
中断。
创建进程等进程相关操作都需要分配内存给进程。这时进程申请和获得的不是物理地址，仅仅是虚
拟地址。
实际的物理内存只有当进程真的去访问新获取的虚拟地址时，才会由“请页机制”产生“缺页”异常，
从而进入分配实际页框的程序。该异常是虚拟内存机制赖以存在的基本保证，它会告诉内核去为进程分
配物理页，并建立对应的页表，这之后虚拟地址才实实在在的映射到了物理地址上。
vmalloc和kmalloc区别
1，kmalloc对应于kfree，分配的内存处于3GB～high_memory之间，这段内核空间与物理内存的映射一一
对应，可以分配连续的物理内存； vmalloc对应于vfree，分配的内存在VMALLOC_START～4GB之间，分配
连续的虚拟内存，但是物理上不一定连续。
2，vmalloc() 分配的物理地址无需连续，而kmalloc() 确保页在物理上是连续的
3，kmalloc分配内存是基于slab，因此slab的一些特性包括着色，对齐等都具备，性能较好。物理地址
和逻辑地址都是连续的。
4，最主要的区别是分配大小的问题，比如你需要28个字节，那一定用kmalloc，如果用vmalloc，分配不
多次机器就罢工了。
尽管仅仅在某些情况下才需要物理上连续的内存块，但是，很多内核代码都调用kmalloc()，而不是
用vmalloc()获得内存。这主要是出于性能的考虑。vmalloc()函数为了把物理上不连续的页面转换为虚
拟地址空间上连续的页，必须专门建立页表项。还有，通过 vmalloc()获得的页必须一个一个的进行映
射（因为它们物理上不是连续的），这就会导致比直接内存映射大得多的缓冲区刷新。因为这些原因，
vmalloc()仅在绝对必要时才会使用，最典型的就是为了获得大块内存时，例如，当模块被动态插入到内
核中时，就把模块装载到由vmalloc()分配的内存上。
http://blog.csdn.net/mengzhuicanyang/article/details/6954991
进程地址空间
前边我已经说过了内核是如何管理物理内存。但事实是内核是操作系统的核心，不光管理本身的内存，
还要管理进程的地址空间。linux操作系统采用虚拟内存技术，所有进程之间以虚拟方式共享内存。进程
地址空间由每个进程中的线性地址区组成，而且更为重要的特点是内核允许进程使用该空间中的地址。
通常情况况下，每个进程都有唯一的地址空间，而且进程地址空间之间彼此互不相干。但是进程之间也
可以选择共享地址空间，这样的进程就叫做线程。
内核使用内存描述符结构表示进程的地址空间，由结构体mm_struct结构体表示，定义在
linux/sched.h中，如下：
struct mm_struct {
struct vm_area_struct *mmap; /* list of memory areas */
struct rb_root mm_rb; /* red-black tree of VMAs */
struct vm_area_struct *mmap_cache; /* last used memory area */
unsigned long free_area_cache; /* 1st address space hole */
pgd_t *pgd; /* page global directory */
atomic_t mm_users; /* address space users */
atomic_t mm_count; /* primary usage counter */
int map_count; /* number of memory areas */
struct rw_semaphore mmap_sem; /* memory area semaphore */
spinlock_t page_table_lock; /* page table lock */
struct list_head mmlist; /* list of all mm_structs */
unsigned long start_code; /* start address of code */
unsigned long end_code; /* final address of code */
unsigned long start_data; /* start address of data */
unsigned long end_data; /* final address of data */
unsigned long start_brk; /* start address of heap */
unsigned long brk; /* final address of heap */
unsigned long start_stack; /* start address of stack */
unsigned long arg_start; /* start of arguments */
unsigned long arg_end; /* end of arguments */
unsigned long env_start; /* start of environment */
unsigned long env_end; /* end of environment */
unsigned long rss; /* pages allocated */
unsigned long total_vm; /* total number of pages */
unsigned long locked_vm; /* number of locked pages */
unsigned long def_flags; /* default access flags */
unsigned long cpu_vm_mask; /* lazy TLB switch mask */
unsigned long swap_address; /* last scanned address */
unsigned dumpable:1; /* can this mm core dump? */
int used_hugetlb; /* used hugetlb pages? */
mm_context_t context; /* arch-specific data */
int core_waiters; /* thread core dump waiters */
struct completion *core_startup_done; /* core start completion */
struct completion core_done; /* core end completion */
rwlock_t ioctx_list_lock; /* AIO I/O list lock */
struct kioctx *ioctx_list; /* AIO I/O list */
struct kioctx default_kioctx; /* AIO default I/O context */
};
mm_users记录了正在使用该地址的进程数目(比如有两个进程在使用，那就为2)。mm_count是该结
构的主引用计数，只要mm_users不为0，它就为1。但其为0时，后者就为0。这时也就说明再也没有指向
该mm_struct结构体的引用了，这时该结构体会被销毁。内核之所以同时使用这两个计数器是为了区别主
使用计数器和使用该地址空间的进程的数目。mmap和mm_rb描述的都是同一个对象：该地址空间中的全部
内存区域。不同只是前者以链表，后者以红黑树的形式组织。所有的mm_struct结构体都通过自身的
mmlist域连接在一个双向链表中，该链表的首元素是init_mm内存描述符，它代表init进程的地址空间。
另外需要注意，操作该链表的时候需要使用mmlist_lock锁来防止并发访问，该锁定义在文件
kernel/fork.c中。内存描述符的总数在mmlist_nr全局变量中，该变量也定义在文件fork.c中。
我前边说过的进程描述符中有一个mm域，这里边存放的就是该进程使用的内存描述符，通过
current->mm便可以指向当前进程的内存描述符。fork函数利用copy_mm()函数就实现了复制父进程的内
存描述符，而子进程中的mm_struct结构体实际是通过文件kernel/fork.c中的allocate_mm()宏从
mm_cachep slab缓存中分配得到的。通常，每个进程都有唯一的mm_struct结构体。
前边也说过，在linux中，进程和线程其实是一样的，唯一的不同点就是是否共享这里的地址空间
。这个可以通过CLONE_VM标志来实现。linux内核并不区别对待它们，线程对内核来说仅仅是一个共向特
定资源的进程而已。好了，如果你设置这个标志了，似乎很多问题都解决了。不再要allocate_mm函数了
，前边刚说作用。而且在copy_mm()函数中将mm域指向其父进程的内存描述符就可以了，如下：
if (clone_flags & CLONE_VM) {
/*
* current is the parent process and
* tsk is the child process during a fork()
*/
atomic_inc(¤t->mm->mm_users);
tsk->mm = current->mm;
}
最后，当进程退出的时候，内核调用exit_mm()函数，这个函数调用mmput()来减少内存描述符中
的mm_users用户计数。如果计数降为0，继续调用mmdrop函数，减少mm_count使用计数。如果使用计数也
为0，则调用free_mm()宏通过kmem_cache_free()函数将mm_struct结构体归还到mm_cachep slab缓存中
。
但对于内核而言，内核线程没有进程地址空间，也没有相关的内存描述符，内核线程对应的进程
描述符中mm域也为空。但内核线程还是需要使用一些数据的，比如页表，为了避免内核线程为内存描述
符和页表浪费内存，也为了当新内核线程运行时，避免浪费处理器周期向新地址空间进行切换，内核线
程将直接使用前一个进程的内存描述符。回忆一下我刚说的进程调度问题，当一个进程被调度时，进程
结构体中mm域指向的地址空间会被装载到内存，进程描述符中的active_mm域会被更新，指向新的地址空
间。但我们这里的内核是没有mm域(为空)，所以，当一个内核线程被调度时，内核发现它的mm域为NULL
，就会保留前一个进程的地址空间，随后内核更新内核线程对应的进程描述符中的active域，使其指向
前一个进程的内存描述符。所以在需要的时候，内核线程便可以使用前一个进程的页表。因为内核线程
不妨问用户空间的内存，所以它们仅仅使用地址空间中和内核内存相关的信息，这些信息的含义和普通
进程完全相同。
内存区域由vm_area_struct结构体描述，定义在linux/mm.h中，内存区域在内核中也经常被称作
虚拟内存区域或VMA.它描述了指定地址空间内连续区间上的一个独立内存范围。内核将每个内存区域作
为一个单独的内存对象管理，每个内存区域都拥有一致的属性。结构体如下：
struct vm_area_struct {
struct mm_struct *vm_mm; /* associated mm_struct */
unsigned long vm_start; /* VMA start, inclusive */
unsigned long vm_end; /* VMA end , exclusive */
struct vm_area_struct *vm_next; /* list of VMA's */
pgprot_t vm_page_prot; /* access permissions */
unsigned long vm_flags; /* flags */
struct rb_node vm_rb; /* VMA's node in the tree */
union { /* links to address_space->i_mmap or i_mmap_nonlinear */
struct {
struct list_head list;
void *parent;
struct vm_area_struct *head;
} vm_set;
struct prio_tree_node prio_tree_node;
} shared;
struct list_head anon_vma_node; /* anon_vma entry */
struct anon_vma *anon_vma; /* anonymous VMA object */
struct vm_operations_struct *vm_ops; /* associated ops */
unsigned long vm_pgoff; /* offset within file */
struct file *vm_file; /* mapped file, if any */
void *vm_private_data; /* private data */
};
每个内存描述符都对应于地址进程空间中的唯一区间。vm_mm域指向和VMA相关的mm_struct结构体
。两个独立的进程将同一个文件映射到各自的地址空间，它们分别都会有一个vm_area_struct结构体来
标志自己的内存区域；但是如果两个线程共享一个地址空间，那么它们也同时共享其中的所有
vm_area_struct结构体。
在上面的vm_flags域中存放的是VMA标志，标志了内存区域所包含的页面的行为和信息，反映了内
核处理页面所需要遵循的行为准则，如下表下述：
image
上表已经相当详细了，而且给出了说明，我就不说了。在vm_area_struct结构体中的vm_ops域指
向域指定内存区域相关的操作函数表，内核使用表中的方法操作VMA。vm_area_struct作为通用对象代表
了任何类型的内存区域，而操作表描述针对特定的对象实例的特定方法。操作函数表由
vm_operations_struct结构体表示，定义在linux/mm.h中，如下:
struct vm_operations_struct {
void (*open) (struct vm_area_struct *);
void (*close) (struct vm_area_struct *);
struct page * (*nopage) (struct vm_area_struct *, unsigned long, int);
int (*populate) (struct vm_area_struct *, unsigned long, unsigned long,pgprot_t,
unsigned long, int);
};
open:当指定的内存区域被加入到一个地址空间时，该函数被调用。
close：当指定的内存区域从地址空间删除时，该函数被调用。
nopages:当要访问的页不在物理内存中时，该函数被页错误处理程序调用。
populate：该函数被系统调用remap_pages调用来为将要发生的缺页中断预映射一个新映射。
记性好的你一定记得内存描述符中的mmap和mm_rb域都独立地指向与内存描述符相关的全体内存区
域对象。它们包含完全相同的vm_area_struct结构体的指针，仅仅组织方式不同而已。前者以链表的方
式进行组织，所有的区域按地址增长的方向排序，mmap域指向链表中第一个内存区域，链中最后一个VMA
结构体指针指向空。而mm_rb域采用红--黑树连接所有的内存区域对象。它指向红--黑输的根节点。地址
空间中每一个vm_area_struct结构体通过自身的vm_rb域连接到树中。关于红黑二叉树结构我就不细讲了
，以后可能会详细说这个问题。内核之所以采用这两种结构来表示同一内存区域，主要是链表结构便于
遍历所有节点，而红黑树结构体便于在地址空间中定位特定内存区域的节点。我么可以使用/proc文件系
统和pmap工具查看给定进程的内存空间和其中所包含的内存区域。这里就不细说了。
内核也为我们提供了对内存区域操作的API，定义在linux/mm.h中：
(1)find_vma<定义在mm/mmap.c>中，该函数在指定的地址空间中搜索一个vm_end大于addr的内存区域。
换句话说，该函数寻找第一个包含
addr或者首地址大于addr的内存区域，如果没有发现这样的区域，该函数返回NULL；否则返回指向
匹配的内存区域的vm_area_struct结构
体指针。
(2)find_vma_prev().函数定义和声明分别在文件mm/mmap.c中和文件linux/mm.h中，它和find_vma()工
作方式相同，但返回的是第一个小于
addr的VMA.
(3)find_vma_intersection().定义在文件linux/mm.h中，返回第一个和指定地址区间相交的VMA,该函数
是一个内敛函数。
接下来要说的两个函数就非常重要了，它们负责创建和删除地址空间。
内核使用do_mmap()函数创建一个新的线性地址空间。但如果创建的地址区间和一个已经存在的地
址区间相邻，并且它们具有相同的访问权限的话，那么两个区间将合并为一个。如果不能合并，那么就
确实需要创建一个新的vma了，但无论哪种情况，do_mmap()函数都会将一个地址区间加入到进程的地址
空间中。这个函数定义在linux/mm.h中，如下：
1
unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long len, unsigned
long prot,unsigned long flag, unsigned long offset)
这个函数中由file指定文件，具体映射的是文件中从偏移offset处开始，长度为len字节的范围内
的数据，如果file参数是NULL并且offset参数也是0，那么就代表这次映射没有和文件相关，该情况被称
作匿名映射。如果指定了文件和偏移量，那么该映射被称为文件映射(file-backed mapping)，其中参数
prot指定内存区域中页面的访问权限，这些访问权限定义在asm/mman.h中，如下：
image
flag参数指定了VMA标志，这些标志定义在asm/mman.h中，如下：
image
如果系统调用do_mmap的参数中有无效参数，那么它返回一个负值；否则，它会在虚拟内存中分配
一个合适的新内存区域，如果有可能的话，将新区域和临近区域进行合并，否则内核从vm_area_cach
ep长字节缓存中分配一个vm_area_struct结构体，并且使用vma_link()函数将新分配的内存区域添加到
地址空间的内存区域链表和红黑树中，随后还要更新内存描述符中的total_vm域，然后才返回新分配的
地址区间的初始地址。在用户空间，我们可以通过mmap()系统调用获取内核函数do_mmap()的功能，这个
在unix环境高级编程中讲的很详细，我就不好意思继续说了。我们继续往下走。
我们说既然有了创建，当然要有删除了，是不？do_mummp()函数就是干这事的。它从特定的进程地址空
间中删除指定地址空间，该函数定义在文件linux/mm.h中，如下：
int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
第一个参数指定要删除区域所在的地址空间，删除从地址start开始，长度为len字节的地址空间
，如果成功，返回0，否则返回负的错误码。与之相对应的用户空间系统调用是munmap。
下面开始最后一点内容：页表
我们知道应用程序操作的对象是映射到物理内存之上的虚拟内存，但是处理器直接操作的确实物
理内存。所以当应用程序访问一个虚拟地址时，首先必须将虚拟地址转化为物理地址，然后处理器才能
解析地址访问请求。这个转换工作需要通过查询页面才能完成，概括地讲，地址转换需要将虚拟地址分
段，使每段虚地址都作为一个索引指向页表，而页表项则指向下一级别的页表或者指向最终的物理页面
。linux中使用三级页表完成地址转换。多数体系结构中，搜索页表的工作由硬件完成，下表描述了虚拟
地址通过页表找到物理地址的过程：
image
在上面这个图中，顶级页表是页全局目录(PGD)，二级页表是中间页目录(PMD).最后一级是页表
(PTE),该页表结构指向物理页。上图中的页表对应的结构体定义在文件asm/page.h中。为了加快查找速
度，在linux中实现了快表(TLB),其本质是一个缓冲器，作为一个将虚拟地址映射到物理地址的硬件缓存
，当请求访问一个虚拟地址时，处理器将首先检查TLB中是否缓存了该虚拟地址到物理地址的映射，如果
找到了，物理地址就立刻返回，否则，就需要再通过页表搜索需要的物理地址。
========
Linux进程地址空间分析
http://blog.csdn.net/hjl243632044/article/details/7218283目录(?)[+]
本文是操作系统课存储器管理学习完后老师的一些补充资料。较详细的介绍了Linux下进程地址空
间的分配，并做了验证性实验。需要原始文档的，请点击下载。
验证性实验分为“一个进程地址空间的分析”和“多个进程地址空间的分析”（本次分析为了简便
只针对两个进程）。前者主要是为了验证一个进程中code segment,data segment,bss segment,及heap
和memory mapping 的地址是否如资料中所述落在了内存中相应的位置。后者主要是对两个进程做的对照
分析。具体的说明我将以注释的形式添加在相应位置。
下面是有关进程地址空间分配的资料：
下面是相关的验证性论文：
Linux进程地址空间的分析
一、单一进程地址空间分析
pth-memory是专门设计来显示进程中不同区域的逻辑地址的实验程序，主要是要了解多线程情况下，不
同线程的运行堆栈地址如何规划，顺便也把几个基本进程区域地址显示出来。
1、pth-memory.c
pth-memory.c的源代码如下，其中关键语句均已标红。
[cpp] view plain copy
/* pth-memory.c : memmory layout in multiple thread program
*To compile: gcc -o pth-memory pth-memory.c -lpthread
*/
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
pthread_t thread[2];
int number=1;
void *thread_local_ptr1, *thread_local_ptr2, *thread_local_ptr3;//记录线程1，2，3的起始位置
void *code_ptr, *bss_ptr, *data_ptr;//记录代码段，数据段，bss段的起始位置（bss segment 用
来存放程序中未初始化的一段内存区域）
void *heap_ptr, *mmap_ptr;//记录堆起始地址，内存映射地址（mmap memory mapping 内存映射）
void *thread1()
{
int test1;
test1=number;
thread_local_ptr1 = (void *) &test1;//test1 的地址可以代表thread1的地址
pthread_exit(NULL);
}
void *thread2()
{
int test2;
test2=number;
thread_local_ptr2 = (void *) &test2;
pthread_exit(NULL);
}
void thread_create(void)
{
memset(&thread, 0, sizeof(thread));// memset:作用是在一段内存块中填充某个给定的值
，它是对较大的结构体或数组进行清零操作的一种最快方法
if(pthread_create(&thread[0], NULL, thread1, NULL) != 0)
printf("Fail to create thread 1.\n");
else
printf("Thread 1 established.\n");
if(pthread_create(&thread[1], NULL, thread2, NULL) != 0)
printf("Fail to create thread 2.\n");
else
printf("Thread 2 established.\n");
}
void thread_wait(void)
{
if(thread[0] !=0)
pthread_join(thread[0],NULL);
if(thread[1] !=0)
pthread_join(thread[1],NULL);
}
int main()
{
int x;
<span style="color:#ff0000;">thread_local_ptr3 = (void *)&x;//获取主线程执行开始处地址
code_ptr = (void *)&thread_wait;//获取代码段地址
data_ptr = (void *)&number;//获取数据段地址
bss_ptr = (void *)&code_ptr;//获取未初始化内存地址</span>
heap_ptr = malloc(4);
mmap_ptr = mmap(NULL, 4, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0);
printf("Try to demonstrate how the memory layout looks like in a multi-thread
process.\n");
thread_create();
thread_wait();
<span style="color:#ff0000;">printf("\ncode: %x\n",(int)code_ptr);
printf("data: %x\n",(int)data_ptr);
printf("bss: %x\n",(int)bss_ptr);
printf("heap: %x\n",(int)heap_ptr);
printf("mmap: %x\n",(int)mmap_ptr);
printf("thread1 stack: %x\n",(int)thread_local_ptr1);
printf("thread2 stack: %x\n",(int)thread_local_ptr2);
printf("main thread stack: %x\n",(int)thread_local_ptr3);</span>
scanf("%d", &x);
free(heap_ptr);
munmap(mmap_ptr,4);
return 0;
}
2、pth-memory.output
pth-memory执行输出结果中地址相关部分如下，需要说明的是，输出内容与上面程序不是完全对应，因
为这是早期版本的执行结果；后面要和其他进程比较内存信息，所以用的是截取/proc下相关文件时的运
行结果。
[cpp] view plain copy
code: 80486a2 ①
data: 804a02c ②
bss: 804a03c ③
thread1 stack: b7e893c4 ④
thread2 stack: b76883c4 ⑤
main thread stack: bfdda310 ⑥
3、pth-memory.maps
pth-memory运行时截取的maps文件如下，与输出结果中各项对应的进程地址空间区域均已标红。
二、不同进程地址空间分析
1、用到的文件
对进程地址空间的分析主要用两个数据文件：.maps文件和.pages文件，后者是从.pagemap文件用
hexdump导出的文件，便于阅读分析，已经把大批相同内容用“*”省略，并给出了文件中的偏移地址。
（1）分析方法
从.maps文件找到需要分析区域的起止地址，根据地址除以0x200可折算出在页表导出文件中的偏移量
（0x200原因：页长0x1000/页表项长8），对比相应内容可以知道是否映射到相同的物理地址。
（2）分析内容
相同程序对应的不同进程，其代码区是否相同；数据区是否独立；动态链接函数库是否是同一个副本。
不同程序对应的不同进程，动态链接函数库是否是同一个副本。
2、相同程序对应的不同进程
注释：此处主要是为了说明两个相同程序中，内存映射（逻辑地址、权限、文件路径），数据段，代码
段，动态链接库在系统内存中逻辑上都是相同的（进程间的物理地址肯定不同了—引用内核中相同的动
态链接库除外）。
选用的程序是bash，两个bash的进程相关文件名分别是bash.0.*和bash.1.*。 bash.0.maps和
bash.1.maps文件对比情况见下表，为便于对比，对文件内容做了一些简化调整。需要对比的部分均标红
。
（1）代码区情况对比
对比bash.0.maps与bash.1.maps中的代码区，逻辑地址范围均是08048000-080ec000，对应pages文件中
偏移量为00040240-00040760，pages文件对比如下表所示，相关部分标红。
bash.0.pages
bash.1.pages
00000000 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 06
*
00040240 53 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
00040250 51 ff 01 00 00 00 00 86 50 ff 01 00 00 00 00 86
00040260 3e ff 01 00 00 00 00 86 3d ff 01 00 00 00 00 86
00040270 3c ff 01 00 00 00 00 86 3b ff 01 00 00 00 00 86
00040280 3a ff 01 00 00 00 00 86 04 ff 01 00 00 00 00 86
00040290 00 00 00 00 00 00 00 00 23 ff 01 00 00 00 00 86
000402a0 1c ff 01 00 00 00 00 86 1d ff 01 00 00 00 00 86
000402b0 1b ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
000402c0 1e ff 01 00 00 00 00 86 1f ff 01 00 00 00 00 86
000402d0 08 ff 01 00 00 00 00 86 54 ff 01 00 00 00 00 86
000402e0 72 ff 01 00 00 00 00 86 71 ff 01 00 00 00 00 86
000402f0 70 ff 01 00 00 00 00 86 6f ff 01 00 00 00 00 86
00040300 6e ff 01 00 00 00 00 86 6d ff 01 00 00 00 00 86
00040310 6c ff 01 00 00 00 00 86 6b ff 01 00 00 00 00 86
00040320 6a ff 01 00 00 00 00 86 69 ff 01 00 00 00 00 86
00040330 68 ff 01 00 00 00 00 86 67 ff 01 00 00 00 00 86
00040340 3f fe 01 00 00 00 00 86 3e fe 01 00 00 00 00 86
00040350 3d fe 01 00 00 00 00 86 3c fe 01 00 00 00 00 86
00040360 3b fe 01 00 00 00 00 86 3a fe 01 00 00 00 00 86
00040370 39 fe 01 00 00 00 00 86 38 fe 01 00 00 00 00 86
00040380 37 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
00040390 35 fe 01 00 00 00 00 86 34 fe 01 00 00 00 00 86
000403a0 33 fe 01 00 00 00 00 86 50 fe 01 00 00 00 00 86
000403b0 6e fe 01 00 00 00 00 86 6d fe 01 00 00 00 00 86
000403c0 6c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
000403d0 00 00 00 00 00 00 00 00 24 15 00 00 00 00 00 86
000403e0 23 15 00 00 00 00 00 86 22 15 00 00 00 00 00 86
000403f0 21 15 00 00 00 00 00 86 20 15 00 00 00 00 00 86
00040400 1f 15 00 00 00 00 00 86 1e 15 00 00 00 00 00 86
00040410 1d 15 00 00 00 00 00 86 1c 15 00 00 00 00 00 86
00040420 1b 15 00 00 00 00 00 86 1a 15 00 00 00 00 00 86
00040430 19 15 00 00 00 00 00 86 18 15 00 00 00 00 00 86
00040440 17 15 00 00 00 00 00 86 16 15 00 00 00 00 00 86
00040450 15 15 00 00 00 00 00 86 a7 15 00 00 00 00 00 86
00040460 a6 15 00 00 00 00 00 86 6a fe 01 00 00 00 00 86
00040470 69 fe 01 00 00 00 00 86 68 fe 01 00 00 00 00 86
00040480 67 fe 01 00 00 00 00 86 66 fe 01 00 00 00 00 86
00040490 65 fe 01 00 00 00 00 86 64 fe 01 00 00 00 00 86
000404a0 63 fe 01 00 00 00 00 86 62 fe 01 00 00 00 00 86
000404b0 61 fe 01 00 00 00 00 86 60 fe 01 00 00 00 00 86
000404c0 5f fe 01 00 00 00 00 86 5e fe 01 00 00 00 00 86
000404d0 00 00 00 00 00 00 00 00 5c fe 01 00 00 00 00 86
000404e0 5b fe 01 00 00 00 00 86 5a fe 01 00 00 00 00 86
000404f0 59 fe 01 00 00 00 00 86 58 fe 01 00 00 00 00 86
00040500 00 00 00 00 00 00 00 00 56 fe 01 00 00 00 00 86
00040510 55 fe 01 00 00 00 00 86 54 fe 01 00 00 00 00 86
00040520 53 fe 01 00 00 00 00 86 52 fe 01 00 00 00 00 86
00040530 6f fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
00040540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00040550 00 00 00 00 00 00 00 00 09 15 00 00 00 00 00 86
00040560 08 15 00 00 00 00 00 86 07 15 00 00 00 00 00 86
00040570 06 15 00 00 00 00 00 86 05 15 00 00 00 00 00 86
00040580 04 15 00 00 00 00 00 86 03 15 00 00 00 00 00 86
00040590 02 15 00 00 00 00 00 86 01 15 00 00 00 00 00 86
000405a0 00 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00
000405b0 7e fe 01 00 00 00 00 86 7d fe 01 00 00 00 00 86
000405c0 7c fe 01 00 00 00 00 86 7b fe 01 00 00 00 00 86
000405d0 00 00 00 00 00 00 00 00 79 fe 01 00 00 00 00 86
000405e0 78 fe 01 00 00 00 00 86 77 fe 01 00 00 00 00 86
000405f0 76 fe 01 00 00 00 00 86 75 fe 01 00 00 00 00 86
00040600 00 00 00 00 00 00 00 00 73 fe 01 00 00 00 00 86
00040610 72 fe 01 00 00 00 00 86 1a 41 01 00 00 00 00 86
00040620 19 41 01 00 00 00 00 86 18 41 01 00 00 00 00 86
00040630 2c fe 01 00 00 00 00 86 2b fe 01 00 00 00 00 86
00040640 2a fe 01 00 00 00 00 86 29 fe 01 00 00 00 00 86
00040650 28 fe 01 00 00 00 00 86 27 fe 01 00 00 00 00 86
00040660 26 fe 01 00 00 00 00 86 25 fe 01 00 00 00 00 86
00040670 24 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
00040680 4f fe 01 00 00 00 00 86 4e fe 01 00 00 00 00 86
00040690 4d fe 01 00 00 00 00 86 4c fe 01 00 00 00 00 86
000406a0 4b fe 01 00 00 00 00 86 4a fe 01 00 00 00 00 86
000406b0 49 fe 01 00 00 00 00 86 48 fe 01 00 00 00 00 86
000406c0 47 fe 01 00 00 00 00 86 46 fe 01 00 00 00 00 86
000406d0 45 fe 01 00 00 00 00 86 44 fe 01 00 00 00 00 86
000406e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
00040730 49 ff 01 00 00 00 00 86 48 ff 01 00 00 00 00 86
00040740 47 ff 01 00 00 00 00 86 46 ff 01 00 00 00 00 86
00040750 45 ff 01 00 00 00 00 86 44 ff 01 00 00 00 00 86
00040760 a2 45 01 00 00 00 00 86 b1 45 01 00 00 00 00 86
00000000 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 06
*
00040240 53 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
00040250 51 ff 01 00 00 00 00 86 50 ff 01 00 00 00 00 86
00040260 3e ff 01 00 00 00 00 86 3d ff 01 00 00 00 00 86
00040270 3c ff 01 00 00 00 00 86 3b ff 01 00 00 00 00 86
00040280 3a ff 01 00 00 00 00 86 04 ff 01 00 00 00 00 86
00040290 00 00 00 00 00 00 00 00 23 ff 01 00 00 00 00 86
000402a0 1c ff 01 00 00 00 00 86 1d ff 01 00 00 00 00 86
000402b0 1b ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
000402c0 1e ff 01 00 00 00 00 86 1f ff 01 00 00 00 00 86
000402d0 08 ff 01 00 00 00 00 86 54 ff 01 00 00 00 00 86
000402e0 72 ff 01 00 00 00 00 86 71 ff 01 00 00 00 00 86
000402f0 70 ff 01 00 00 00 00 86 6f ff 01 00 00 00 00 86
00040300 6e ff 01 00 00 00 00 86 6d ff 01 00 00 00 00 86
00040310 6c ff 01 00 00 00 00 86 6b ff 01 00 00 00 00 86
00040320 6a ff 01 00 00 00 00 86 69 ff 01 00 00 00 00 86
00040330 68 ff 01 00 00 00 00 86 67 ff 01 00 00 00 00 86
00040340 3f fe 01 00 00 00 00 86 3e fe 01 00 00 00 00 86
00040350 3d fe 01 00 00 00 00 86 3c fe 01 00 00 00 00 86
00040360 3b fe 01 00 00 00 00 86 3a fe 01 00 00 00 00 86
00040370 39 fe 01 00 00 00 00 86 38 fe 01 00 00 00 00 86
00040380 37 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
00040390 35 fe 01 00 00 00 00 86 34 fe 01 00 00 00 00 86
000403a0 33 fe 01 00 00 00 00 86 50 fe 01 00 00 00 00 86
000403b0 6e fe 01 00 00 00 00 86 6d fe 01 00 00 00 00 86
000403c0 6c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
000403d0 00 00 00 00 00 00 00 00 24 15 00 00 00 00 00 86
000403e0 23 15 00 00 00 00 00 86 22 15 00 00 00 00 00 86
000403f0 21 15 00 00 00 00 00 86 20 15 00 00 00 00 00 86
00040400 1f 15 00 00 00 00 00 86 1e 15 00 00 00 00 00 86
00040410 1d 15 00 00 00 00 00 86 1c 15 00 00 00 00 00 86
00040420 1b 15 00 00 00 00 00 86 1a 15 00 00 00 00 00 86
00040430 19 15 00 00 00 00 00 86 18 15 00 00 00 00 00 86
00040440 17 15 00 00 00 00 00 86 16 15 00 00 00 00 00 86
00040450 15 15 00 00 00 00 00 86 a7 15 00 00 00 00 00 86
00040460 a6 15 00 00 00 00 00 86 6a fe 01 00 00 00 00 86
00040470 69 fe 01 00 00 00 00 86 68 fe 01 00 00 00 00 86
00040480 67 fe 01 00 00 00 00 86 66 fe 01 00 00 00 00 86
00040490 65 fe 01 00 00 00 00 86 64 fe 01 00 00 00 00 86
000404a0 63 fe 01 00 00 00 00 86 62 fe 01 00 00 00 00 86
000404b0 61 fe 01 00 00 00 00 86 60 fe 01 00 00 00 00 86
000404c0 5f fe 01 00 00 00 00 86 5e fe 01 00 00 00 00 86
000404d0 00 00 00 00 00 00 00 00 5c fe 01 00 00 00 00 86
000404e0 5b fe 01 00 00 00 00 86 5a fe 01 00 00 00 00 86
000404f0 59 fe 01 00 00 00 00 86 58 fe 01 00 00 00 00 86
00040500 00 00 00 00 00 00 00 00 56 fe 01 00 00 00 00 86
00040510 55 fe 01 00 00 00 00 86 54 fe 01 00 00 00 00 86
00040520 53 fe 01 00 00 00 00 86 52 fe 01 00 00 00 00 86
00040530 6f fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
00040540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00040550 00 00 00 00 00 00 00 00 09 15 00 00 00 00 00 86
00040560 08 15 00 00 00 00 00 86 07 15 00 00 00 00 00 86
00040570 06 15 00 00 00 00 00 86 05 15 00 00 00 00 00 86
00040580 04 15 00 00 00 00 00 86 03 15 00 00 00 00 00 86
00040590 02 15 00 00 00 00 00 86 01 15 00 00 00 00 00 86
000405a0 00 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00
000405b0 7e fe 01 00 00 00 00 86 7d fe 01 00 00 00 00 86
000405c0 7c fe 01 00 00 00 00 86 7b fe 01 00 00 00 00 86
000405d0 00 00 00 00 00 00 00 00 79 fe 01 00 00 00 00 86
000405e0 78 fe 01 00 00 00 00 86 77 fe 01 00 00 00 00 86
000405f0 76 fe 01 00 00 00 00 86 75 fe 01 00 00 00 00 86
00040600 00 00 00 00 00 00 00 00 73 fe 01 00 00 00 00 86
00040610 72 fe 01 00 00 00 00 86 1a 41 01 00 00 00 00 86
00040620 19 41 01 00 00 00 00 86 18 41 01 00 00 00 00 86
00040630 2c fe 01 00 00 00 00 86 2b fe 01 00 00 00 00 86
00040640 2a fe 01 00 00 00 00 86 29 fe 01 00 00 00 00 86
00040650 28 fe 01 00 00 00 00 86 27 fe 01 00 00 00 00 86
00040660 26 fe 01 00 00 00 00 86 25 fe 01 00 00 00 00 86
00040670 24 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
00040680 4f fe 01 00 00 00 00 86 4e fe 01 00 00 00 00 86
00040690 4d fe 01 00 00 00 00 86 4c fe 01 00 00 00 00 86
000406a0 4b fe 01 00 00 00 00 86 4a fe 01 00 00 00 00 86
000406b0 49 fe 01 00 00 00 00 86 48 fe 01 00 00 00 00 86
000406c0 47 fe 01 00 00 00 00 86 46 fe 01 00 00 00 00 86
000406d0 45 fe 01 00 00 00 00 86 44 fe 01 00 00 00 00 86
000406e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
00040730 49 ff 01 00 00 00 00 86 48 ff 01 00 00 00 00 86
00040740 47 ff 01 00 00 00 00 86 46 ff 01 00 00 00 00 86
00040750 45 ff 01 00 00 00 00 86 44 ff 01 00 00 00 00 86
00040760 02 42 01 00 00 00 00 86 3b 42 01 00 00 00 00 86
（2）数据区情况对比
对比bash.0.maps与bash.1.maps中的代码区，逻辑地址范围均是080ed000-080f2000，对应pages文件中
偏移量为00040768-000407b0，pages文件对比如下表所示，相关部分标红。
bash.0.pages
bash.1.pages
00040760 a2 45 01 00 00 00 00 86 b1 45 01 00 00 00 00 86
00040770 bb 45 01 00 00 00 00 86 67 47 01 00 00 00 00 86
00040780 68 47 01 00 00 00 00 86 48 40 01 00 00 00 00 86
00040790 ba 40 01 00 00 00 00 86 b8 45 01 00 00 00 00 86
000407a0 4a 40 01 00 00 00 00 86 49 40 01 00 00 00 00 86
000407b0 b3 45 01 00 00 00 00 86 bb 40 01 00 00 00 00 86
00040760 02 42 01 00 00 00 00 86 3b 42 01 00 00 00 00 86
00040770 1d 42 01 00 00 00 00 86 61 40 01 00 00 00 00 86
00040780 62 40 01 00 00 00 00 86 ed 3e 01 00 00 00 00 86
00040790 d2 3e 01 00 00 00 00 86 3f 42 01 00 00 00 00 86
000407a0 d0 3e 01 00 00 00 00 86 ee 3e 01 00 00 00 00 86
000407b0 14 42 01 00 00 00 00 86 d3 3e 01 00 00 00 00 86
（3）动态链接库情况对比
对比bash.0.maps与bash.1.maps中libc的映射区，bash.0的逻辑地址范围是b7f37000-b8074000，对应
pages文件中偏移量为 005bf9b8-005c03a0； bash.1的逻辑地址范围是b7e85000-b7fc2000，对应pages
文件中偏移量为 005bf428-005bfe10；pages文件对比如下表所示，相关部分标红。
bash.0.pages
bash.1.pages
005bf9b0 a6 45 01 00 00 00 00 86 da ff 01 00 00 00 00 86
005bf9c0 d9 ff 01 00 00 00 00 86 d8 ff 01 00 00 00 00 86
005bf9d0 d7 ff 01 00 00 00 00 86 dd fe 01 00 00 00 00 86
005bf9e0 dc fe 01 00 00 00 00 86 db fe 01 00 00 00 00 86
005bf9f0 da fe 01 00 00 00 00 86 d9 fe 01 00 00 00 00 86
005bfa00 d8 fe 01 00 00 00 00 86 d7 fe 01 00 00 00 00 86
005bfa10 d6 fe 01 00 00 00 00 86 d5 fe 01 00 00 00 00 86
005bfa20 d4 fe 01 00 00 00 00 86 d3 fe 01 00 00 00 00 86
005bfa30 d2 fe 01 00 00 00 00 86 d1 fe 01 00 00 00 00 86
005bfa40 d0 fe 01 00 00 00 00 86 cf fe 01 00 00 00 00 86
005bfa50 ce fe 01 00 00 00 00 86 cd fe 01 00 00 00 00 86
005bfa60 cc fe 01 00 00 00 00 86 cb fe 01 00 00 00 00 86
005bfa70 00 00 00 00 00 00 00 00 c9 fe 01 00 00 00 00 86
005bfa80 c8 fe 01 00 00 00 00 86 c7 fe 01 00 00 00 00 86
005bfa90 c6 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfaa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfab0 c2 fe 01 00 00 00 00 86 de fe 01 00 00 00 00 86
005bfac0 bc 14 00 00 00 00 00 86 b3 ff 01 00 00 00 00 86
005bfad0 b2 ff 01 00 00 00 00 86 b1 ff 01 00 00 00 00 86
005bfae0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfaf0 ae ff 01 00 00 00 00 86 ad ff 01 00 00 00 00 86
005bfb00 00 00 00 00 00 00 00 00 ab ff 01 00 00 00 00 86
005bfb10 aa ff 01 00 00 00 00 86 a9 ff 01 00 00 00 00 86
005bfb20 a8 ff 01 00 00 00 00 86 a7 ff 01 00 00 00 00 86
005bfb30 a6 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfb40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfb90 00 00 00 00 00 00 00 00 97 fe 01 00 00 00 00 86
005bfba0 d2 14 00 00 00 00 00 86 d1 14 00 00 00 00 00 86
005bfbb0 d0 14 00 00 00 00 00 86 cf 14 00 00 00 00 00 86
005bfbc0 ce 14 00 00 00 00 00 86 cd 14 00 00 00 00 00 86
005bfbd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfbf0 c8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfc10 00 00 00 00 00 00 00 00 c3 14 00 00 00 00 00 86
005bfc20 e3 14 00 00 00 00 00 86 e2 14 00 00 00 00 00 86
005bfc30 e1 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfc50 dd 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfc70 00 00 00 00 00 00 00 00 f7 14 00 00 00 00 00 86
005bfc80 15 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc90 13 ff 01 00 00 00 00 86 12 ff 01 00 00 00 00 86
005bfca0 11 ff 01 00 00 00 00 86 10 ff 01 00 00 00 00 86
005bfcb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfcd0 94 ff 01 00 00 00 00 86 93 ff 01 00 00 00 00 86
005bfce0 00 00 00 00 00 00 00 00 91 ff 01 00 00 00 00 86
005bfcf0 90 ff 01 00 00 00 00 86 8f ff 01 00 00 00 00 86
005bfd00 8e ff 01 00 00 00 00 86 8d ff 01 00 00 00 00 86
005bfd10 8c ff 01 00 00 00 00 86 8b ff 01 00 00 00 00 86
005bfd20 8a ff 01 00 00 00 00 86 89 ff 01 00 00 00 00 86
005bfd30 88 ff 01 00 00 00 00 86 87 ff 01 00 00 00 00 86
005bfd40 86 ff 01 00 00 00 00 86 85 ff 01 00 00 00 00 86
005bfd50 84 ff 01 00 00 00 00 86 83 ff 01 00 00 00 00 86
005bfd60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfd70 80 ff 01 00 00 00 00 86 bf 14 00 00 00 00 00 86
005bfd80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfd90 ba ff 01 00 00 00 00 86 b9 ff 01 00 00 00 00 86
005bfda0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfde0 29 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfdf0 27 15 00 00 00 00 00 86 26 15 00 00 00 00 00 86
005bfe00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfe50 00 00 00 00 00 00 00 00 8b fe 01 00 00 00 00 86
005bfe60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfe70 88 fe 01 00 00 00 00 86 87 fe 01 00 00 00 00 86
005bfe80 86 fe 01 00 00 00 00 86 85 fe 01 00 00 00 00 86
005bfe90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bffa0 00 00 00 00 00 00 00 00 bb 14 00 00 00 00 00 86
005bffb0 ba 14 00 00 00 00 00 86 b9 14 00 00 00 00 00 86
005bffc0 b8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bffd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bffe0 00 00 00 00 00 00 00 00 b3 14 00 00 00 00 00 86
005bfff0 b2 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005c0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005c0010 ae 14 00 00 00 00 00 86 ad 14 00 00 00 00 00 86
005c0020 ac 14 00 00 00 00 00 86 ab 14 00 00 00 00 00 86
005c0030 aa 14 00 00 00 00 00 86 a9 14 00 00 00 00 00 86
005c0040 00 00 00 00 00 00 00 00 a7 14 00 00 00 00 00 86
005c0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c0090 98 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005c00a0 00 00 00 00 00 00 00 00 4b 15 00 00 00 00 00 86
005c00b0 4a 15 00 00 00 00 00 86 49 15 00 00 00 00 00 86
005c00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c01a0 00 00 00 00 00 00 00 00 ad fe 01 00 00 00 00 86
005c01b0 00 00 00 00 00 00 00 00 ab fe 01 00 00 00 00 86
005c01c0 aa fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005c01d0 00 00 00 00 00 00 00 00 a7 fe 01 00 00 00 00 86
005c01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005c01f0 a4 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005c0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c0220 9e fe 01 00 00 00 00 86 9d fe 01 00 00 00 00 86
005c0230 9c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005c0240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c0280 00 00 00 00 00 00 00 00 f5 14 00 00 00 00 00 86
005c0290 f4 14 00 00 00 00 00 86 f3 14 00 00 00 00 00 86
005c02a0 f2 14 00 00 00 00 00 86 f1 14 00 00 00 00 00 86
005c02b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005c02c0 ee 14 00 00 00 00 00 86 ed 14 00 00 00 00 00 86
005c02d0 ec 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005c02e0 ea 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005c02f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c03a0 a4 45 01 00 00 00 00 86 a8 45 01 00 00 00 00 86
005bf420 3d 42 01 00 00 00 00 86 da ff 01 00 00 00 00 86
005bf430 d9 ff 01 00 00 00 00 86 d8 ff 01 00 00 00 00 86
005bf440 d7 ff 01 00 00 00 00 86 dd fe 01 00 00 00 00 86
005bf450 dc fe 01 00 00 00 00 86 db fe 01 00 00 00 00 86
005bf460 da fe 01 00 00 00 00 86 d9 fe 01 00 00 00 00 86
005bf470 d8 fe 01 00 00 00 00 86 d7 fe 01 00 00 00 00 86
005bf480 d6 fe 01 00 00 00 00 86 d5 fe 01 00 00 00 00 86
005bf490 d4 fe 01 00 00 00 00 86 d3 fe 01 00 00 00 00 86
005bf4a0 d2 fe 01 00 00 00 00 86 d1 fe 01 00 00 00 00 86
005bf4b0 d0 fe 01 00 00 00 00 86 cf fe 01 00 00 00 00 86
005bf4c0 ce fe 01 00 00 00 00 86 cd fe 01 00 00 00 00 86
005bf4d0 cc fe 01 00 00 00 00 86 cb fe 01 00 00 00 00 86
005bf4e0 00 00 00 00 00 00 00 00 c9 fe 01 00 00 00 00 86
005bf4f0 c8 fe 01 00 00 00 00 86 c7 fe 01 00 00 00 00 86
005bf500 c6 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf520 c2 fe 01 00 00 00 00 86 de fe 01 00 00 00 00 86
005bf530 bc 14 00 00 00 00 00 86 b3 ff 01 00 00 00 00 86
005bf540 b2 ff 01 00 00 00 00 86 b1 ff 01 00 00 00 00 86
005bf550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf560 ae ff 01 00 00 00 00 86 ad ff 01 00 00 00 00 86
005bf570 00 00 00 00 00 00 00 00 ab ff 01 00 00 00 00 86
005bf580 aa ff 01 00 00 00 00 86 a9 ff 01 00 00 00 00 86
005bf590 a8 ff 01 00 00 00 00 86 a7 ff 01 00 00 00 00 86
005bf5a0 a6 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf5b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf600 00 00 00 00 00 00 00 00 97 fe 01 00 00 00 00 86
005bf610 d2 14 00 00 00 00 00 86 d1 14 00 00 00 00 00 86
005bf620 d0 14 00 00 00 00 00 86 cf 14 00 00 00 00 00 86
005bf630 ce 14 00 00 00 00 00 86 cd 14 00 00 00 00 00 86
005bf640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf660 c8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf680 00 00 00 00 00 00 00 00 c3 14 00 00 00 00 00 86
005bf690 e3 14 00 00 00 00 00 86 e2 14 00 00 00 00 00 86
005bf6a0 e1 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf6b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf6c0 dd 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf6d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf6e0 00 00 00 00 00 00 00 00 f7 14 00 00 00 00 00 86
005bf6f0 15 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf700 13 ff 01 00 00 00 00 86 12 ff 01 00 00 00 00 86
005bf710 11 ff 01 00 00 00 00 86 10 ff 01 00 00 00 00 86
005bf720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf740 94 ff 01 00 00 00 00 86 93 ff 01 00 00 00 00 86
005bf750 00 00 00 00 00 00 00 00 91 ff 01 00 00 00 00 86
005bf760 90 ff 01 00 00 00 00 86 8f ff 01 00 00 00 00 86
005bf770 8e ff 01 00 00 00 00 86 8d ff 01 00 00 00 00 86
005bf780 8c ff 01 00 00 00 00 86 8b ff 01 00 00 00 00 86
005bf790 8a ff 01 00 00 00 00 86 89 ff 01 00 00 00 00 86
005bf7a0 88 ff 01 00 00 00 00 86 87 ff 01 00 00 00 00 86
005bf7b0 86 ff 01 00 00 00 00 86 85 ff 01 00 00 00 00 86
005bf7c0 84 ff 01 00 00 00 00 86 83 ff 01 00 00 00 00 86
005bf7d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf7e0 80 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf7f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf800 ba ff 01 00 00 00 00 86 b9 ff 01 00 00 00 00 86
005bf810 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf850 29 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf860 27 15 00 00 00 00 00 86 26 15 00 00 00 00 00 86
005bf870 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf8c0 00 00 00 00 00 00 00 00 8b fe 01 00 00 00 00 86
005bf8d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf8e0 88 fe 01 00 00 00 00 86 87 fe 01 00 00 00 00 86
005bf8f0 86 fe 01 00 00 00 00 86 85 fe 01 00 00 00 00 86
005bf900 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfa10 00 00 00 00 00 00 00 00 bb 14 00 00 00 00 00 86
005bfa20 ba 14 00 00 00 00 00 86 b9 14 00 00 00 00 00 86
005bfa30 b8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfa40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfa50 00 00 00 00 00 00 00 00 b3 14 00 00 00 00 00 86
005bfa60 b2 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfa70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfa80 ae 14 00 00 00 00 00 86 ad 14 00 00 00 00 00 86
005bfa90 ac 14 00 00 00 00 00 86 ab 14 00 00 00 00 00 86
005bfaa0 aa 14 00 00 00 00 00 86 a9 14 00 00 00 00 00 86
005bfab0 00 00 00 00 00 00 00 00 a7 14 00 00 00 00 00 86
005bfac0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfb00 98 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfb10 00 00 00 00 00 00 00 00 4b 15 00 00 00 00 00 86
005bfb20 4a 15 00 00 00 00 00 86 49 15 00 00 00 00 00 86
005bfb30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfc10 00 00 00 00 00 00 00 00 ad fe 01 00 00 00 00 86
005bfc20 00 00 00 00 00 00 00 00 ab fe 01 00 00 00 00 86
005bfc30 aa fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc40 00 00 00 00 00 00 00 00 a7 fe 01 00 00 00 00 86
005bfc50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfc60 a4 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfc90 9e fe 01 00 00 00 00 86 9d fe 01 00 00 00 00 86
005bfca0 9c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfcb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfcf0 00 00 00 00 00 00 00 00 f5 14 00 00 00 00 00 86
005bfd00 f4 14 00 00 00 00 00 86 f3 14 00 00 00 00 00 86
005bfd10 f2 14 00 00 00 00 00 86 f1 14 00 00 00 00 00 86
005bfd20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfd30 ee 14 00 00 00 00 00 86 ed 14 00 00 00 00 00 86
005bfd40 ec 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfd50 ea 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfd60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfe10 0a 42 01 00 00 00 00 86 06 42 01 00 00 00 00 86
3、不同程序对应的不同进程
注释：此处主要是为了说明，尽管程序不同，但程序中引用的动态链接库可能是相同的（下面数据中带*
的处表明和上面的内容相同，省略。显然可以看出有的链接库bash用了，pth-memory没有用。或者情况
相反）
分析pth-memory.maps中libc的映射区，逻辑地址范围是b7e8b000-b7fc8000，对应pages文件中偏移量为
005bf458-005bfe40；bash.0.pages与pth-memory.pages对比如下表所示，相关部分标红。
bash.0.pages
pth-memory.pages
005bf9b0 a6 45 01 00 00 00 00 86 da ff 01 00 00 00 00 86
005bf9c0 d9 ff 01 00 00 00 00 86 d8 ff 01 00 00 00 00 86
005bf9d0 d7 ff 01 00 00 00 00 86 dd fe 01 00 00 00 00 86
005bf9e0 dc fe 01 00 00 00 00 86 db fe 01 00 00 00 00 86
005bf9f0 da fe 01 00 00 00 00 86 d9 fe 01 00 00 00 00 86
005bfa00 d8 fe 01 00 00 00 00 86 d7 fe 01 00 00 00 00 86
005bfa10 d6 fe 01 00 00 00 00 86 d5 fe 01 00 00 00 00 86
005bfa20 d4 fe 01 00 00 00 00 86 d3 fe 01 00 00 00 00 86
005bfa30 d2 fe 01 00 00 00 00 86 d1 fe 01 00 00 00 00 86
005bfa40 d0 fe 01 00 00 00 00 86 cf fe 01 00 00 00 00 86
005bfa50 ce fe 01 00 00 00 00 86 cd fe 01 00 00 00 00 86
005bfa60 cc fe 01 00 00 00 00 86 cb fe 01 00 00 00 00 86
005bfa70 00 00 00 00 00 00 00 00 c9 fe 01 00 00 00 00 86
005bfa80 c8 fe 01 00 00 00 00 86 c7 fe 01 00 00 00 00 86
005bfa90 c6 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfaa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfab0 c2 fe 01 00 00 00 00 86 de fe 01 00 00 00 00 86
005bfac0 bc 14 00 00 00 00 00 86 b3 ff 01 00 00 00 00 86
005bfad0 b2 ff 01 00 00 00 00 86 b1 ff 01 00 00 00 00 86
005bfae0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfaf0 ae ff 01 00 00 00 00 86 ad ff 01 00 00 00 00 86
005bfb00 00 00 00 00 00 00 00 00 ab ff 01 00 00 00 00 86
005bfb10 aa ff 01 00 00 00 00 86 a9 ff 01 00 00 00 00 86
005bfb20 a8 ff 01 00 00 00 00 86 a7 ff 01 00 00 00 00 86
005bfb30 a6 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfb40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfb90 00 00 00 00 00 00 00 00 97 fe 01 00 00 00 00 86
005bfba0 d2 14 00 00 00 00 00 86 d1 14 00 00 00 00 00 86
005bfbb0 d0 14 00 00 00 00 00 86 cf 14 00 00 00 00 00 86
005bfbc0 ce 14 00 00 00 00 00 86 cd 14 00 00 00 00 00 86
005bfbd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfbf0 c8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfc10 00 00 00 00 00 00 00 00 c3 14 00 00 00 00 00 86
005bfc20 e3 14 00 00 00 00 00 86 e2 14 00 00 00 00 00 86
005bfc30 e1 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfc50 dd 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfc70 00 00 00 00 00 00 00 00 f7 14 00 00 00 00 00 86
005bfc80 15 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfc90 13 ff 01 00 00 00 00 86 12 ff 01 00 00 00 00 86
005bfca0 11 ff 01 00 00 00 00 86 10 ff 01 00 00 00 00 86
005bfcb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfcd0 94 ff 01 00 00 00 00 86 93 ff 01 00 00 00 00 86
005bfce0 00 00 00 00 00 00 00 00 91 ff 01 00 00 00 00 86
005bfcf0 90 ff 01 00 00 00 00 86 8f ff 01 00 00 00 00 86
005bfd00 8e ff 01 00 00 00 00 86 8d ff 01 00 00 00 00 86
005bfd10 8c ff 01 00 00 00 00 86 8b ff 01 00 00 00 00 86
005bfd20 8a ff 01 00 00 00 00 86 89 ff 01 00 00 00 00 86
005bfd30 88 ff 01 00 00 00 00 86 87 ff 01 00 00 00 00 86
005bfd40 86 ff 01 00 00 00 00 86 85 ff 01 00 00 00 00 86
005bfd50 84 ff 01 00 00 00 00 86 83 ff 01 00 00 00 00 86
005bfd60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfd70 80 ff 01 00 00 00 00 86 bf 14 00 00 00 00 00 86
005bfd80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfd90 ba ff 01 00 00 00 00 86 b9 ff 01 00 00 00 00 86
005bfda0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfde0 29 15 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfdf0 27 15 00 00 00 00 00 86 26 15 00 00 00 00 00 86
005bfe00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfe50 00 00 00 00 00 00 00 00 8b fe 01 00 00 00 00 86
005bfe60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfe70 88 fe 01 00 00 00 00 86 87 fe 01 00 00 00 00 86
005bfe80 86 fe 01 00 00 00 00 86 85 fe 01 00 00 00 00 86
005bfe90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bffa0 00 00 00 00 00 00 00 00 bb 14 00 00 00 00 00 86
005bffb0 ba 14 00 00 00 00 00 86 b9 14 00 00 00 00 00 86
005bffc0 b8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bffd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bffe0 00 00 00 00 00 00 00 00 b3 14 00 00 00 00 00 86
005bfff0 b2 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005c0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005c0010 ae 14 00 00 00 00 00 86 ad 14 00 00 00 00 00 86
005c0020 ac 14 00 00 00 00 00 86 ab 14 00 00 00 00 00 86
005c0030 aa 14 00 00 00 00 00 86 a9 14 00 00 00 00 00 86
005c0040 00 00 00 00 00 00 00 00 a7 14 00 00 00 00 00 86
005c0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c0090 98 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005c00a0 00 00 00 00 00 00 00 00 4b 15 00 00 00 00 00 86
005c00b0 4a 15 00 00 00 00 00 86 49 15 00 00 00 00 00 86
005c00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c01a0 00 00 00 00 00 00 00 00 ad fe 01 00 00 00 00 86
005c01b0 00 00 00 00 00 00 00 00 ab fe 01 00 00 00 00 86
005c01c0 aa fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005c01d0 00 00 00 00 00 00 00 00 a7 fe 01 00 00 00 00 86
005c01e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005c01f0 a4 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005c0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c0220 9e fe 01 00 00 00 00 86 9d fe 01 00 00 00 00 86
005c0230 9c fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005c0240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c0280 00 00 00 00 00 00 00 00 f5 14 00 00 00 00 00 86
005c0290 f4 14 00 00 00 00 00 86 f3 14 00 00 00 00 00 86
005c02a0 f2 14 00 00 00 00 00 86 f1 14 00 00 00 00 00 86
005c02b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005c02c0 ee 14 00 00 00 00 00 86 ed 14 00 00 00 00 00 86
005c02d0 ec 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005c02e0 ea 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005c02f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005c03a0 a4 45 01 00 00 00 00 86 a8 45 01 00 00 00 00 86
005bf450 86 49 01 00 00 00 00 86 da ff 01 00 00 00 00 86
005bf460 d9 ff 01 00 00 00 00 86 d8 ff 01 00 00 00 00 86
005bf470 d7 ff 01 00 00 00 00 86 dd fe 01 00 00 00 00 86
005bf480 dc fe 01 00 00 00 00 86 db fe 01 00 00 00 00 86
005bf490 da fe 01 00 00 00 00 86 d9 fe 01 00 00 00 00 86
005bf4a0 d8 fe 01 00 00 00 00 86 d7 fe 01 00 00 00 00 86
005bf4b0 d6 fe 01 00 00 00 00 86 d5 fe 01 00 00 00 00 86
005bf4c0 d4 fe 01 00 00 00 00 86 d3 fe 01 00 00 00 00 86
005bf4d0 d2 fe 01 00 00 00 00 86 d1 fe 01 00 00 00 00 86
005bf4e0 d0 fe 01 00 00 00 00 86 cf fe 01 00 00 00 00 86
005bf4f0 ce fe 01 00 00 00 00 86 cd fe 01 00 00 00 00 86
005bf500 cc fe 01 00 00 00 00 86 cb fe 01 00 00 00 00 86
005bf510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf5a0 00 00 00 00 00 00 00 00 ab ff 01 00 00 00 00 86
005bf5b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf5c0 a8 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf5d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf630 00 00 00 00 00 00 00 00 97 fe 01 00 00 00 00 86
005bf640 d2 14 00 00 00 00 00 86 d1 14 00 00 00 00 00 86
005bf650 d0 14 00 00 00 00 00 86 cf 14 00 00 00 00 00 86
005bf660 00 00 00 00 00 00 00 00 cd 14 00 00 00 00 00 86
005bf670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf690 c8 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf6a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf6b0 00 00 00 00 00 00 00 00 c3 14 00 00 00 00 00 86
005bf6c0 e3 14 00 00 00 00 00 86 e2 14 00 00 00 00 00 86
005bf6d0 e1 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf6e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf6f0 dd 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf710 00 00 00 00 00 00 00 00 f7 14 00 00 00 00 00 86
005bf720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf730 13 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf740 11 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf750 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf780 00 00 00 00 00 00 00 00 91 ff 01 00 00 00 00 86
005bf790 90 ff 01 00 00 00 00 86 8f ff 01 00 00 00 00 86
005bf7a0 8e ff 01 00 00 00 00 86 8d ff 01 00 00 00 00 86
005bf7b0 8c ff 01 00 00 00 00 86 8b ff 01 00 00 00 00 86
005bf7c0 8a ff 01 00 00 00 00 86 89 ff 01 00 00 00 00 86
005bf7d0 88 ff 01 00 00 00 00 86 87 ff 01 00 00 00 00 86
005bf7e0 86 ff 01 00 00 00 00 86 85 ff 01 00 00 00 00 86
005bf7f0 84 ff 01 00 00 00 00 86 83 ff 01 00 00 00 00 86
005bf800 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bf810 80 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bf820 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bf910 00 00 00 00 00 00 00 00 87 fe 01 00 00 00 00 86
005bf920 00 00 00 00 00 00 00 00 85 fe 01 00 00 00 00 86
005bf930 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfa40 00 00 00 00 00 00 00 00 bb 14 00 00 00 00 00 86
005bfa50 ba 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfa60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfa80 00 00 00 00 00 00 00 00 b3 14 00 00 00 00 00 86
005bfa90 b2 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfaa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfab0 ae 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfac0 00 00 00 00 00 00 00 00 ab 14 00 00 00 00 00 86
005bfad0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfb30 98 ff 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfb40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfc70 a8 fe 01 00 00 00 00 86 a7 fe 01 00 00 00 00 86
005bfc80 a6 fe 01 00 00 00 00 86 a5 fe 01 00 00 00 00 86
005bfc90 a4 fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfcc0 9e fe 01 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfcd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfd30 f4 14 00 00 00 00 00 86 f3 14 00 00 00 00 00 86
005bfd40 00 00 00 00 00 00 00 00 f1 14 00 00 00 00 00 86
005bfd50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
005bfd60 ee 14 00 00 00 00 00 86 00 00 00 00 00 00 00 00
005bfd70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
005bfe40 cb 3a 01 00 00 00 00 86 87 29 01 00 00 00 00 86
========
811
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
