yunfeng zhang wrote: > have an *exact* map to foo.so in disk
This is where your misunderstanding arises. Just as 5+3 can add up to the same result as 4+4, so you cannot ignore that the final mapped addresses you are seeing add up to the same result via different routes. Compile your sources using --save-temps, and look at the differences in the generated assembly files. By looking only at the final results, you are losing information about how those results are arrived at. cheers, DaveK