Meaning of read and syscall with arguments

Question

I'm playing with strace and ltrace tools to get information about a program which contains a prompt for a user entry.

With strace, after the read from the prompt is called, there is an openat of a specific file in readOnly:

openat(AT_FDCWD, "file", O_RDONLY) = 3
read(3, "22d72c", 6)                    = 6

I know that the second argument for read is supposed to be a buffer and that read starts at the buffer, but what exatly does it mean here? Does it means it starts at the 22d72c bit? or is 22d72c a key and it reads it's value?

As for syscall, I'm getting that when I use ltrace, after a scanf for the prompt and a fopen to open the file, it returns similar syscall such as:

syscall(0, 3, 0x56127f5c96c0, 6) 

What is the meaning of syscall third argument here? (0x56127f5c96c0)

Answer 1

No. "22d72c" are the 6 characters that read read from your file... just check the beginning of file.

Indeed if you read from STDIN_FILENO using read (or for example use fgets; strace will output

read(0, 

and stop there waiting for the read to complete so that it can print out the characters read!

---

As for

syscall(0, 3, 0x56127f5c96c0, 6) 

that output is from a program that doesn't know how to decode the system call parameters for system call 0 (read), so it just displays some sensible value - all small numbers in decimal. 0x56127f5c96c0 is the pointer to the first character of the buffer you're reading into.

Answer 2

0x56127f5c96c0 is the pointer passed to read. It's not very useful to you is it? strace was nice enough to decode the system call, notice that's a pointer argument, and show you what it points to instead.