ptrace — How strace and gdb Really Work
strace, gdb and ltrace all stand on one syscall. Anatomy of ptrace: syscall stops, signal injection, int3 breakpoints and the real cost of tracing a process.
Signals in Linux — SIGKILL, SIGTERM, SIGCHLD and the Anatomy of a Handler
How signals work in Linux: delivery, dispositions, why SIGKILL is uncatchable, SIGCHLD and zombies, and async-signal-safety in handlers.
Signals in Linux — SIGKILL, SIGTERM, SIGCHLD and the Anatomy of a Handler Read Post »
futex — How Mutexes Really Work in Linux
Why pthread_mutex_lock usually doesn’t make a syscall. The userspace fast path (atomic CAS), the FUTEX_WAIT/WAKE slow path under contention, thundering herd, and cross-process futexes.
mmap — When Memory-Mapped I/O Beats read() and write()
Why databases map files instead of reading through read(). Demand paging, MAP_SHARED vs MAP_PRIVATE, the relationship with the page cache, and when mmap is a trap (SIGBUS, small files, random writes).
mmap — When Memory-Mapped I/O Beats read() and write() Read Post »
malloc internals — Why free() Doesn’t Return Memory to the System
Why free() doesn’t return memory to the system. Arenas, bins, chunks, the brk vs mmap boundary, the mechanics of fragmentation, and when jemalloc beats the default glibc allocator.
malloc internals — Why free() Doesn’t Return Memory to the System Read Post »
awk as a Full Programming Language — Not Just {print $2}
awk isn’t a one-liner for cutting columns — it’s a Turing-complete language. The record-field model, associative arrays, state machines, mawk vs gawk, and when awk beats Python by an order of magnitude.
awk as a Full Programming Language — Not Just {print $2} Read Post »
ELF and Dynamic Linking — What Happens Before main() Runs
What happens before main() runs. The ELF format, ld.so, GOT/PLT, lazy binding, and LD_PRELOAD as an interposition vector — the full mechanics of loading a dynamically linked program.
ELF and Dynamic Linking — What Happens Before main() Runs Read Post »
strace as a Debugging Primitive — When the Stack Trace Lies
Most engineers know strace -p PID as a panic button. How to read its output, use -f/-c/-k, and observe the syscall boundary when your logs lie.
strace as a Debugging Primitive — When the Stack Trace Lies Read Post »
Anatomy of a Segfault — From MMU Through Kernel to gdb Core Dump
What exactly happens when a process touches a bad address. From the MMU and page table through the kernel page fault handler to core dump analysis in gdb — null deref, stack overflow, use-after-free.
Anatomy of a Segfault — From MMU Through Kernel to gdb Core Dump Read Post »
.bashrc — Anatomy of Shell Startup and Performance Optimization
Your terminal takes 800 ms to start. Bash loading anatomy, lazy loading version managers, completion caching, PS1 without synchronous git status — and how to drop to 50 ms without compromises.
.bashrc — Anatomy of Shell Startup and Performance Optimization Read Post »