I am studying the vdso mechanism in Linux. To find the DSO, I can parse the auxiliary vector passed to the program's entry point. The AT_SYSINFO_EHDR entry will point to the vDSO.
My question is why, can't I access the vDSO using the addresses showed in /proc/self/maps ? Shouldn't the result be the same? I tried to access vDSO using those addresses in several ways, but I always got a wrong memory area. I am using a x86_64 bit.
For example, I don't understand why using dd to dump that memory area does not work in 64 bit operating system, while it seems to work on 32bit. Any Idea?
dd if=/prcc/self/mem of=vDSO.bin count=1 bs=4096 skip=0xffffffffff600000
I know I cannot use a hexadecimal offset, I put it like that because it's more clear to read.
skip must be given in units of bs.