Even if code can't be placed on the stack, an attacker could use a buffer overflow to make a program "return" to an existing subroutine ( such as a routine in the C library) and create an attack. 即使不能将代码放到堆栈上,攻击者也可以利用缓冲区溢出来使程序“返回”某个现有的子例程(比如C库中的某个子例程),从而进行攻击。
This behavior does not include explicit function calls; it's advisable to have key mappings for quick custom code checks, such as subroutine length. 这种行为不包括显式的函数调用;建议为子例程长度检查等快速定制代码检查设置键映射。
Functional maps provide reusable code that can be called like a subroutine from within one or more map rules. 功能性映射提供可重用的代码,可以在一个或多个映射规则中像子例程一样调用它们。
The other types of code units, which you will see in later sections, are TID for kernel thread, MOD for module, and SYM for symbol ( subroutine name). 在后面的部分您将看到的其他类型的代码单元是表示内核线程的TID,表示模块的MOD,以及表示符号(子例程名)的SYM。