diff options
| author | johannst <johannst@users.noreply.github.com> | 2020-03-14 18:01:23 +0000 |
|---|---|---|
| committer | johannst <johannst@users.noreply.github.com> | 2020-03-14 18:01:23 +0000 |
| commit | 21e8db012f8c46f75e43a40da3f3e2676363c291 (patch) | |
| tree | bf0dc931f0cb679b8423c602c802ab05dea7314b /index.html | |
| parent | e5426455329d5b9439491d697405b8386836a154 (diff) | |
| download | notes-21e8db012f8c46f75e43a40da3f3e2676363c291.tar.gz notes-21e8db012f8c46f75e43a40da3f3e2676363c291.zip | |
deploy: 951ccb67565f34a0aa1b23ad6eef647aed5e0b4b
Diffstat (limited to 'index.html')
| -rw-r--r-- | index.html | 236 |
1 files changed, 107 insertions, 129 deletions
@@ -3,7 +3,7 @@ <head> <!-- Book generated using mdBook --> <meta charset="UTF-8"> - <title>gdb - Notes</title> + <title>ld.so - Notes</title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> @@ -81,7 +81,7 @@ <nav id="sidebar" class="sidebar" aria-label="Table of contents"> <div id="sidebar-scrollbox" class="sidebar-scrollbox"> - <ol class="chapter"><li class="expanded "><a href="gdb.html"><strong aria-hidden="true">1.</strong> gdb</a></li></ol> + <ol class="chapter"><li class="expanded "><a href="ld.so.html"><strong aria-hidden="true">1.</strong> ld.so</a></li><li class="expanded "><a href="git.html"><strong aria-hidden="true">2.</strong> git</a></li><li class="expanded "><a href="gdb.html"><strong aria-hidden="true">3.</strong> gdb</a></li><li class="expanded "><a href="radare2.html"><strong aria-hidden="true">4.</strong> radare2</a></li><li class="expanded "><a href="emacs.html"><strong aria-hidden="true">5.</strong> emacs</a></li><li class="expanded "><a href="fish.html"><strong aria-hidden="true">6.</strong> fish</a></li><li class="expanded "><a href="strace.html"><strong aria-hidden="true">7.</strong> strace</a></li><li class="expanded "><a href="lsof.html"><strong aria-hidden="true">8.</strong> lsof</a></li><li class="expanded "><a href="pidstat.html"><strong aria-hidden="true">9.</strong> pidstat</a></li><li class="expanded "><a href="time.html"><strong aria-hidden="true">10.</strong> time</a></li><li class="expanded "><a href="pmap.html"><strong aria-hidden="true">11.</strong> pmap</a></li><li class="expanded "><a href="pstack.html"><strong aria-hidden="true">12.</strong> pstack</a></li><li class="expanded "><a href="perf.html"><strong aria-hidden="true">13.</strong> perf</a></li><li class="expanded "><a href="oprofile.html"><strong aria-hidden="true">14.</strong> OProfile</a></li><li class="expanded "><a href="od.html"><strong aria-hidden="true">15.</strong> od</a></li><li class="expanded "><a href="xxd.html"><strong aria-hidden="true">16.</strong> xxd</a></li><li class="expanded "><a href="readelf.html"><strong aria-hidden="true">17.</strong> readelf</a></li><li class="expanded "><a href="objdump.html"><strong aria-hidden="true">18.</strong> objdump</a></li><li class="expanded "><a href="nm.html"><strong aria-hidden="true">19.</strong> nm</a></li><li class="expanded "><a href="c++filt.html"><strong aria-hidden="true">20.</strong> c++filt</a></li></ol> </div> <div id="sidebar-resize-handle" class="sidebar-resize-handle"></div> </nav> @@ -148,135 +148,105 @@ <div id="content" class="content"> <main> - <h1><a class="header" href="#gdb1" id="gdb1">gdb(1)</a></h1> -<h1><a class="header" href="#cli" id="cli">CLI</a></h1> -<pre><code class="language-markdown"> gdb [opts] [prg [-c coredump | -p pid]] - gdb [opts] --args prg <prg-args> - opts: - -p <pid> attach to pid - -c <coredump> use <coredump> - -x <file> execute script <file> before prompt - -ex <cmd> execute command <cmd> before prompt - --tty <tty> set I/O tty for debugee + <h1><a class="header" href="#ldso8" id="ldso8">ld.so(8)</a></h1> +<h2><a class="header" href="#environment-variables" id="environment-variables">Environment variables</a></h2> +<pre><code class="language-console"> LD_PRELOAD=<l_so> colon separated list of libso's to be pre loaded + LD_DEBUG=<opts> comman separated list of debug options + =help list available options + =libs show library search path + =files processing of input files + =symbols show search path for symbol lookup + =bindings show against which definition a symbol is bound </code></pre> -<h1><a class="header" href="#interactive-usage" id="interactive-usage">Interactive usage</a></h1> -<pre><code class="language-markdown"> tty <tty> - Set <tty> as tty for debugee. - Make sure nobody reads from target tty, easiest is to spawn a shell - and run following in target tty: - > while true; do sleep 1024; done - - set follow-fork-mode <child | parent> - Specify which process to follow when debuggee makes a fork(2) - syscall. - - sharedlibrary [<regex>] - Load symbols of shared libs loaded by debugee. Optionally use <regex> - to filter libs for symbol loading. - - break [-qualified] <sym> thread <tnum> - Set a breakpoint only for a specific thread. - -qualified: Tred <sym> as fully qualified symbol (quiet handy to set - breakpoints on C symbols in C++ contexts) - - rbreak <regex> - Set breakpoints matching <regex>, where matching internally is done - on: .*<regex>.* - - command [<bp_list>] - Define commands to run after breakpoint hit. If <bp_list> is not - specified attach command to last created breakpoint. Command block - terminated with 'end' token. - - <bp_list>: Space separates list, eg 'command 2 5-8' to run command - for breakpoints: 2,5,6,7,8. - - info functions [<regex>] - List functions matching <regex>. List all functions if no <regex> - provided. - - info variables [<regex>] - List variables matching <regex>. List all variables if no <regex> - provided. - - info handle [<signal>] - Print how to handle <signal>. If no <signal> specified print for all - signals. - - handle <signal> <action> - Configure how gdb handles <signal> sent to debugee. - <action>: - stop/nostop Catch signal in gdb and break. - print/noprint Print message when gdb catches signal. - pass/nopass Pass signal down to debugee. - - catch signal <signal> - Create a catchpoint for <signal>. +<h2><a class="header" href="#ld_preload-load--init-order" id="ld_preload-load--init-order">LD_PRELOAD load & init order</a></h2> +<pre><code class="language-markdown"> > ldd ./main + >> libc.so.6 => /usr/lib/libc.so.6 + + > LD_PRELOAD=liba.so:libb.so ./main + --> + preloaded in this order + <-- + initialized in this order + + - preload order determines the order libs are inserted into the link map + + - resulting link map: + +------+ +------+ +------+ +------+ + | main | -> | liba | -> | libb | -> | libc | + +------+ +------+ +------+ +------+ + + - see preload and init order in action + > LD_DEBUG=files LD_PRELOAD=liba.so:libb.so ./main + # load order (-> determines link map) + >> file=liba.so [0]; generating link map + >> file=libb.so [0]; generating link map + >> file=libc.so.6 [0]; generating link map + + # init order + >> calling init: /usr/lib/libc.so.6 + >> calling init: <path>/libb.so + >> calling init: <path>/liba.so + >> initialize program: ./main + + - see the symbol lookup in action and therefore the link map order + > LD_DEBUG=symbols,bindings LD_PRELOAD=liba.so:libb.so ./main + >> symbol=memcpy; lookup in file=./main [0] + >> symbol=memcpy; lookup in file=<path>/liba.so [0] + >> symbol=memcpy; lookup in file=<path>/libb.so [0] + >> symbol=memcpy; lookup in file=/usr/lib/libc.so.6 [0] + >> binding file ./main [0] to /usr/lib/libc.so.6 [0]: normal symbol + `memcpy' [GLIBC_2.14] </code></pre> -<h1><a class="header" href="#user-commands-macros" id="user-commands-macros">User commands (macros)</a></h1> -<pre><code class="language-markdown"> define <cmd> - # cmds - end - - document <cmd> - # docu - end - - help user-defined List user defined commands. - help <cmd> List documentation for command <cmd>. -</code></pre> -<h1><a class="header" href="#hooks" id="hooks">Hooks</a></h1> -<p>Gdb allows to create two types of command <code>hooks</code> which will be either executed -before or after a certain command.</p> -<pre><code class="language-markdown"> define hook-<cmd> Run commands defined in hook before - # cmds executing <cmd>. - end - - define hookpost-<cmd> Run commands defined in hookpost after - # cmds executing <cmd>. - end -</code></pre> -<h1><a class="header" href="#flows" id="flows">Flows</a></h1> -<h2><a class="header" href="#catch-sigsegv-and-execute-commands-on-occurrence" id="catch-sigsegv-and-execute-commands-on-occurrence">Catch SIGSEGV and execute commands on occurrence</a></h2> -<pre><code class="language-markdown"> catch signal SIGSEGV - command - bt - c - end -</code></pre> -<h2><a class="header" href="#run-backtrace-on-thread-1-batch-mode" id="run-backtrace-on-thread-1-batch-mode">Run <code>backtrace</code> on thread 1 (batch mode)</a></h2> -<pre><code class="language-markdown"> gdb --batch -ex 'thread 1' -ex 'bt' -p <pid> -</code></pre> -<h2><a class="header" href="#script-gdb-for-automating-debugging-sessions" id="script-gdb-for-automating-debugging-sessions">Script gdb for automating debugging sessions</a></h2> -<pre><code class="language-markdown"># run.gdb - set pagination off - - break mmap - command - info reg rdi rsi rdx - bt - c - end - - #initial drop - c -</code></pre> -<p>This script can be used as:</p> -<pre><code class="language-markdown"> gdb -p <pid> -x ./run.gdb --batch &> run.log -</code></pre> -<h2><a class="header" href="#workaround-command--finish-bug" id="workaround-command--finish-bug">Workaround <code>command + finish</code> bug</a></h2> -<p>When using <code>finish</code> action inside a <code>command</code> block, actions after <code>finish</code> are -not executed anymore. To workaround that bug one can create a wrapper function -which calls <code>finish</code>.</p> -<pre><code class="language-markdown"> define handler - bt - finish - info reg rax - end - - command - handler - end +<h2><a class="header" href="#dynamic-linking-x86_64" id="dynamic-linking-x86_64">dynamic linking (x86_64)</a></h2> +<pre><code class="language-makrdown"> - dynamic linking basically works via one indirect jump. It uses a + combination of function trampolines (.plt) and a function pointer table + (.got.plt). On the first call the trampoline sets up some metadata and + then jumps to the ld.so runtime resolve function, which in turn patches + the table with the correct function pointer. + .plt ....... contains function trampolines, usually located in code + segment (rx permission) + .got.plt ... hold the function pointer table + + - following r2 dump shows this + - [0x00401030] indirect jump for 'puts' using function pointer in + _GLOBAL_OFFSET_TABLE_[3] + - initially points to instruction behind 'puts' trampoline [0x00401036] + - this pushes relocation index and then jumps to the first trampoline + [0x00401020] + - the first trampoline jumps to _GLOBAL_OFFSET_TABLE_[2] which will be + filled at program startup by the ld.so with its resolve function + - the resolve function fixes the relocation referenced by the + relocation index pushed by the 'puts' trampoline + - the relocation entry tells the resolve function which symbol to + search for and where to put the function pointer + > readelf -r <main> + >> Relocation section '.rela.plt' at offset 0x4b8 contains 1 entry: + >> Offset Info Type Sym. Value Sym. Name + Addend + >> 000000404018 000200000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0 + - offset points to _GLOBAL_OFFSET_TABLE_[3] + + [0x00401040]> pd 4 @ section..got.plt + ;-- section..got.plt: + ;-- .got.plt: ; [22] -rw- section size 32 named .got.plt + ;-- _GLOBAL_OFFSET_TABLE_: + 0x00404000 .qword 0x0000000000403e10 ; section..dynamic ; obj._DYNAMIC + 0x00404008 .qword 0x0000000000000000 + ; CODE XREF from section..plt @ +0x6 + 0x00404010 .qword 0x0000000000000000 + ;-- reloc.puts: + ; CODE XREF from sym.imp.puts @ 0x401030 + 0x00404018 .qword 0x0000000000401036 ; RELOC 64 puts + + [0x00401040]> pd 6 @ section..plt + ;-- section..plt: + ;-- .plt: ; [12] -r-x section size 32 named .plt + ┌─> 0x00401020 ff35e22f0000 push qword [0x00404008] + ╎ 0x00401026 ff25e42f0000 jmp qword [0x00404010] + ╎ 0x0040102c 0f1f4000 nop dword [rax] + ┌ 6: int sym.imp.puts (const char *s); + └ ╎ 0x00401030 ff25e22f0000 jmp qword [reloc.puts] + ╎ 0x00401036 6800000000 push 0 + └─< 0x0040103b e9e0ffffff jmp sym..plt </code></pre> </main> @@ -286,6 +256,10 @@ which calls <code>finish</code>.</p> + <a rel="next" href="git.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right"> + <i class="fa fa-angle-right"></i> + </a> + <div style="clear: both"></div> </nav> @@ -296,6 +270,10 @@ which calls <code>finish</code>.</p> + <a href="git.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right"> + <i class="fa fa-angle-right"></i> + </a> + </nav> </div> |