What is program break? Where does it start from,0x00?

Question

int brk(void *end_data_segment);
void *sbrk(intptr_t increment);

Calling sbrk() with an increment of 0 can be used to find the current location of the program break.

What is program break? Where does it start from,0x00?

Answer 1

Oversimplifying:

A process has several segments of memory:

• Code (text) segment, which contains the code to be executed.
• Data segment, which contains data the compiler knows about (globals and statics).
• Stack segment, which contains (drumroll...) the stack.

(Of course, nowadays it's much more complex. There is a rodata segment, a uninitialized data segment, mappings allocated via mmap, a vdso, ...)

One traditional way a program can request more memory in a Unix-like OS is to increment the size of the data segment, and use a memory allocator (i.e. malloc() implementation) to manage the resulting space. This is done via the brk() system call, which changes the point where the data segment "breaks"/ends.

Answer 2

A program break is end of the process's data segment. AKA...

the program break is the first location after the end of the uninitialized data segment

As to where it starts from, it's system dependent but probably not 0x00.

Answer 3

These days, sbrk(2) (and brk) are nearly obsolete system calls (and you can nearly forget about them and ignore the old notion of break; focus on understanding mmap(2)). Notice that the sbrk(2) man page says in its NOTES :

Avoid using brk() and sbrk(): the malloc(3) memory allocation package is the portable and comfortable way of allocating memory.

^{(emphasis mine)}

---

Most implementations of malloc(3) (notably the one in musl-libc) are rather using mmap(2) to require memory - and increase their virtual address space - from the kernel (look at that virtual address space wikipage, it has a nice picture). Some malloc-s use sbrk for small allocations, mmap for large ones.

Use strace(1) to find out the system calls (listed in syscalls(2)) done by some given process or command. BTW you'll then find that bash and ls (and probably many other programs) don't make a single call to sbrk.

Explore the virtual address space of some process by using proc(5). Try cat /proc/$$/maps and cat /proc/self/maps and even cat /proc/$$/smaps and read a bit to understand the output.

Be aware of ASLR & vdso(7).

And sbrk is not very thread friendly.

^{(my answer focuses on Linux)}

Answer 4

You are saying that sbrk() is an obsolute system call and that we should use malloc(), but malloc(), according to her documentation, when allocating less memory than 128 KiB (32 pages) uses it. So we shouldn´t use sbrk() directly, but malloc() use it, if allocation is bigger than 128 KiB then malloc() uses mmap() that allocates private pages to the userspace. Finally its a good idea to understand sbrk(), at least for understanding the "Program Break" concept.