I would like to write a program that could parse the output of /proc/<pid>/maps in order to classify them into different categories:

• Image : the page is either a mapping of the binary or one of it's required libraries
• Mapped file : the page maps a specific file like a font for example
• Stack
• Heap
• Private data
• Shareable

As you might have guessed, the main idea is to develop an equivalent of sysinternals's vmmap tool for Linux.

I'm using the pathname field to determine in which category a page could be associated with.

If pathname is the same path as /proc/<pid>/exe symlink, or if it is a dependency, therefore it goes to Image.

If pathname is a file and isn't part of the Image, then it is a Mapped File.

If pathname is matching a pattern like [stack:<tid>] or [heap], then the page is respectively a Stack or a Heap.

While I was looking for some information about /proc/<pid>/maps, I came accross this stackoverflow post missing-heap-section-in-proc-pid-maps , where I discovered that if you were calling malloc with the size parameter above a certain threshold, a private anonymous mapping was created instead of increasing the size of the Heap.

1. How can I know if an anonymous mapping is an independant heap, or something else ?
2. Should I treat all anonymous mapping as [heap] ? If not, how to classify them ?
3. What page could fit into the Private Data, and Shareable categories ?

Thanks !