diff options
| author | johannst <johannst@users.noreply.github.com> | 2020-04-28 09:11:18 +0000 |
|---|---|---|
| committer | johannst <johannst@users.noreply.github.com> | 2020-04-28 09:11:18 +0000 |
| commit | 15230bbb9b1f69def9b0e1b41a097638c0fda734 (patch) | |
| tree | 2b490b2f0b8d6f3eab0af91c7ba5cc557b540af6 /ld.so.html | |
| parent | ce1a0eaa58f7ad07c5389996a90c4b02bdf573fc (diff) | |
| download | notes-15230bbb9b1f69def9b0e1b41a097638c0fda734.tar.gz notes-15230bbb9b1f69def9b0e1b41a097638c0fda734.zip | |
deploy: fef4d6ff2ad9f48e6dccde0f061453e6a3ac624e
Diffstat (limited to 'ld.so.html')
| -rw-r--r-- | ld.so.html | 322 |
1 files changed, 0 insertions, 322 deletions
diff --git a/ld.so.html b/ld.so.html deleted file mode 100644 index 8b18d0f..0000000 --- a/ld.so.html +++ /dev/null @@ -1,322 +0,0 @@ -<!DOCTYPE HTML> -<html lang="en" class="sidebar-visible no-js light"> - <head> - <!-- Book generated using mdBook --> - <meta charset="UTF-8"> - <title>ld.so - Notes</title> - - - <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> - <meta name="description" content=""> - <meta name="viewport" content="width=device-width, initial-scale=1"> - <meta name="theme-color" content="#ffffff" /> - - <link rel="shortcut icon" href="favicon.png"> - <link rel="stylesheet" href="css/variables.css"> - <link rel="stylesheet" href="css/general.css"> - <link rel="stylesheet" href="css/chrome.css"> - <link rel="stylesheet" href="css/print.css" media="print"> - - <!-- Fonts --> - <link rel="stylesheet" href="FontAwesome/css/font-awesome.css"> - <link href="https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800" rel="stylesheet" type="text/css"> - <link href="https://fonts.googleapis.com/css?family=Source+Code+Pro:500" rel="stylesheet" type="text/css"> - - <!-- Highlight.js Stylesheets --> - <link rel="stylesheet" href="highlight.css"> - <link rel="stylesheet" href="tomorrow-night.css"> - <link rel="stylesheet" href="ayu-highlight.css"> - - <!-- Custom theme stylesheets --> - - - - </head> - <body> - <!-- Provide site root to javascript --> - <script type="text/javascript"> - var path_to_root = ""; - var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "light" : "light"; - </script> - - <!-- Work around some values being stored in localStorage wrapped in quotes --> - <script type="text/javascript"> - try { - var theme = localStorage.getItem('mdbook-theme'); - var sidebar = localStorage.getItem('mdbook-sidebar'); - - if (theme.startsWith('"') && theme.endsWith('"')) { - localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1)); - } - - if (sidebar.startsWith('"') && sidebar.endsWith('"')) { - localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1)); - } - } catch (e) { } - </script> - - <!-- Set the theme before any content is loaded, prevents flash --> - <script type="text/javascript"> - var theme; - try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { } - if (theme === null || theme === undefined) { theme = default_theme; } - var html = document.querySelector('html'); - html.classList.remove('no-js') - html.classList.remove('light') - html.classList.add(theme); - html.classList.add('js'); - </script> - - <!-- Hide / unhide sidebar before it is displayed --> - <script type="text/javascript"> - var html = document.querySelector('html'); - var sidebar = 'hidden'; - if (document.body.clientWidth >= 1080) { - try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { } - sidebar = sidebar || 'visible'; - } - html.classList.remove('sidebar-visible'); - html.classList.add("sidebar-" + sidebar); - </script> - - <nav id="sidebar" class="sidebar" aria-label="Table of contents"> - <div id="sidebar-scrollbox" class="sidebar-scrollbox"> - <ol class="chapter"><li class="expanded "><a href="ld.so.html" class="active"><strong aria-hidden="true">1.</strong> ld.so</a></li><li class="expanded "><a href="git.html"><strong aria-hidden="true">2.</strong> git</a></li><li class="expanded "><a href="bash.html"><strong aria-hidden="true">3.</strong> bash</a></li><li class="expanded "><a href="zsh.html"><strong aria-hidden="true">4.</strong> zsh</a></li><li class="expanded "><a href="tmux.html"><strong aria-hidden="true">5.</strong> tmux</a></li><li class="expanded "><a href="awk.html"><strong aria-hidden="true">6.</strong> awk</a></li><li class="expanded "><a href="gdb.html"><strong aria-hidden="true">7.</strong> gdb</a></li><li class="expanded "><a href="radare2.html"><strong aria-hidden="true">8.</strong> radare2</a></li><li class="expanded "><a href="emacs.html"><strong aria-hidden="true">9.</strong> emacs</a></li><li class="expanded "><a href="fish.html"><strong aria-hidden="true">10.</strong> fish</a></li><li class="expanded "><a href="strace.html"><strong aria-hidden="true">11.</strong> strace</a></li><li class="expanded "><a href="lsof.html"><strong aria-hidden="true">12.</strong> lsof</a></li><li class="expanded "><a href="pidstat.html"><strong aria-hidden="true">13.</strong> pidstat</a></li><li class="expanded "><a href="time.html"><strong aria-hidden="true">14.</strong> time</a></li><li class="expanded "><a href="pgrep.html"><strong aria-hidden="true">15.</strong> pgrep</a></li><li class="expanded "><a href="pstack.html"><strong aria-hidden="true">16.</strong> pstack</a></li><li class="expanded "><a href="perf.html"><strong aria-hidden="true">17.</strong> perf</a></li><li class="expanded "><a href="oprofile.html"><strong aria-hidden="true">18.</strong> OProfile</a></li><li class="expanded "><a href="od.html"><strong aria-hidden="true">19.</strong> od</a></li><li class="expanded "><a href="xxd.html"><strong aria-hidden="true">20.</strong> xxd</a></li><li class="expanded "><a href="readelf.html"><strong aria-hidden="true">21.</strong> readelf</a></li><li class="expanded "><a href="objdump.html"><strong aria-hidden="true">22.</strong> objdump</a></li><li class="expanded "><a href="nm.html"><strong aria-hidden="true">23.</strong> nm</a></li><li class="expanded "><a href="c++filt.html"><strong aria-hidden="true">24.</strong> c++filt</a></li><li class="expanded "><a href="c++.html"><strong aria-hidden="true">25.</strong> c++</a></li><li class="expanded "><a href="glibc.html"><strong aria-hidden="true">26.</strong> glibc</a></li><li class="expanded "><a href="gcc.html"><strong aria-hidden="true">27.</strong> gcc</a></li></ol> - </div> - <div id="sidebar-resize-handle" class="sidebar-resize-handle"></div> - </nav> - - <div id="page-wrapper" class="page-wrapper"> - - <div class="page"> - - <div id="menu-bar" class="menu-bar"> - <div id="menu-bar-sticky-container"> - <div class="left-buttons"> - <button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar"> - <i class="fa fa-bars"></i> - </button> - <button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list"> - <i class="fa fa-paint-brush"></i> - </button> - <ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu"> - <li role="none"><button role="menuitem" class="theme" id="light">Light (default)</button></li> - <li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li> - <li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li> - <li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li> - <li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li> - </ul> - - <button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar"> - <i class="fa fa-search"></i> - </button> - - </div> - - <h1 class="menu-title">Notes</h1> - - <div class="right-buttons"> - <a href="print.html" title="Print this book" aria-label="Print this book"> - <i id="print-button" class="fa fa-print"></i> - </a> - - </div> - </div> - </div> - - - <div id="search-wrapper" class="hidden"> - <form id="searchbar-outer" class="searchbar-outer"> - <input type="search" name="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header"> - </form> - <div id="searchresults-outer" class="searchresults-outer hidden"> - <div id="searchresults-header" class="searchresults-header"></div> - <ul id="searchresults"> - </ul> - </div> - </div> - - - <!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM --> - <script type="text/javascript"> - document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible'); - document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible'); - Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) { - link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1); - }); - </script> - - <div id="content" class="content"> - <main> - <h1><a class="header" href="#ldso8" id="ldso8">ld.so(8)</a></h1> -<h2><a class="header" href="#environment-variables" id="environment-variables">Environment Variables</a></h2> -<pre><code class="language-console"> LD_PRELOAD=<l_so> colon separated list of libso's to be pre loaded - LD_DEBUG=<opts> comma separated list of debug options - =help list available options - =libs show library search path - =files processing of input files - =symbols show search path for symbol lookup - =bindings show against which definition a symbol is bound -</code></pre> -<h2><a class="header" href="#ld_preload-initialization-order-and-link-map" id="ld_preload-initialization-order-and-link-map">LD_PRELOAD: Initialization Order and Link Map</a></h2> -<p>Libraries specified in <code>LD_PRELOAD</code> are loaded from <code>left-to-right</code> but -initialized from <code>right-to-left</code>.</p> -<pre><code class="language-markdown"> > ldd ./main - >> libc.so.6 => /usr/lib/libc.so.6 - - > LD_PRELOAD=liba.so:libb.so ./main - --> - preloaded in this order - <-- - initialized in this order -</code></pre> -<p>The preload order determines:</p> -<ul> -<li>the order libraries are inserted into the <code>link map</code></li> -<li>the initialization order for libraries</li> -</ul> -<p>For the example listed above the resulting <code>link map</code> will look like the -following:</p> -<pre><code class="language-makrdown"> +------+ +------+ +------+ +------+ - | main | -> | liba | -> | libb | -> | libc | - +------+ +------+ +------+ +------+ -</code></pre> -<p>This can be seen when running with <code>LD_DEBUG=files</code>:</p> -<pre><code class="language-makrdown"> > LD_DEBUG=files LD_PRELOAD=liba.so:libb.so ./main - # load order (-> determines link map) - >> file=liba.so [0]; generating link map - >> file=libb.so [0]; generating link map - >> file=libc.so.6 [0]; generating link map - - # init order - >> calling init: /usr/lib/libc.so.6 - >> calling init: <path>/libb.so - >> calling init: <path>/liba.so - >> initialize program: ./main -</code></pre> -<p>To verify the <code>link map</code> order we let <code>ld.so</code> resolve the <code>memcpy(3)</code> libc -symbol (used in <em>main</em>) dynamically, while enabling <code>LD_DEBUG=symbols,bindings</code> -to see the resolving in action.</p> -<pre><code class="language-makrdown"> > LD_DEBUG=symbols,bindings LD_PRELOAD=liba.so:libb.so ./main - >> symbol=memcpy; lookup in file=./main [0] - >> symbol=memcpy; lookup in file=<path>/liba.so [0] - >> symbol=memcpy; lookup in file=<path>/libb.so [0] - >> symbol=memcpy; lookup in file=/usr/lib/libc.so.6 [0] - >> binding file ./main [0] to /usr/lib/libc.so.6 [0]: normal symbol `memcpy' [GLIBC_2.14] -</code></pre> -<h2><a class="header" href="#dynamic-linking-x86_64" id="dynamic-linking-x86_64">Dynamic Linking (x86_64)</a></h2> -<p>Dynamic linking basically works via one indirect jump. It uses a combination of -function trampolines (<code>.plt</code> section) and a function pointer table (<code>.got.plt</code> -section). -On the first call the trampoline sets up some metadata and then jumps to the -<code>ld.so</code> runtime resolve function, which in turn patches the table with the -correct function pointer.</p> -<pre><code class="language-makrdown"> .plt ....... procedure linkage table, contains function trampolines, usually - located in code segment (rx permission) - .got.plt ... global offset table for .plt, holds the function pointer table -</code></pre> -<p>Using <code>radare2</code> we can analyze this in more detail:</p> -<pre><code class="language-makrdown"> [0x00401040]> pd 4 @ section..got.plt - ;-- section..got.plt: - ;-- .got.plt: ; [22] -rw- section size 32 named .got.plt - ;-- _GLOBAL_OFFSET_TABLE_: - [0] 0x00404000 .qword 0x0000000000403e10 ; section..dynamic - [1] 0x00404008 .qword 0x0000000000000000 - ; CODE XREF from section..plt @ +0x6 - [2] 0x00404010 .qword 0x0000000000000000 - ;-- reloc.puts: - ; CODE XREF from sym.imp.puts @ 0x401030 - [3] 0x00404018 .qword 0x0000000000401036 ; RELOC 64 puts - - [0x00401040]> pd 6 @ section..plt - ;-- section..plt: - ;-- .plt: ; [12] -r-x section size 32 named .plt - ┌─> 0x00401020 ff35e22f0000 push qword [0x00404008] - ╎ 0x00401026 ff25e42f0000 jmp qword [0x00404010] - ╎ 0x0040102c 0f1f4000 nop dword [rax] - ┌ 6: int sym.imp.puts (const char *s); - └ ╎ 0x00401030 ff25e22f0000 jmp qword [reloc.puts] - ╎ 0x00401036 6800000000 push 0 - └─< 0x0040103b e9e0ffffff jmp sym..plt -</code></pre> -<ul> -<li>At address <code>0x00401030</code> in the <code>.plt</code> section we see the indirect jump for -<code>puts</code> using the function pointer in <code>_GLOBAL_OFFSET_TABLE_[3] (GOT)</code>.</li> -<li><code>GOT[3]</code> initially points to instruction after the <code>puts</code> trampoline -<code>0x00401036</code>.</li> -<li>This pushes the relocation index <code>0</code> and then jumps to the first trampoline -<code>0x00401020</code>.</li> -<li>The first trampoline jumps to <code>GOT[2]</code> which will be filled at program -startup by the <code>ld.so</code> with its resolve function.</li> -<li>The <code>ld.so</code> resolve function fixes the relocation referenced by the -relocation index pushed by the <code>puts</code> trampoline.</li> -<li>The relocation entry at index <code>0</code> tells the resolve function which symbol to -search for and where to put the function pointer: -<pre><code class="language-makrdown"> > readelf -r <main> - >> Relocation section '.rela.plt' at offset 0x4b8 contains 1 entry: - >> Offset Info Type Sym. Value Sym. Name + Addend - >> 000000404018 000200000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0 -</code></pre> -As we can see the offset from relocation at index <code>0</code> points to <code>GOT[3]</code>.</li> -</ul> - - </main> - - <nav class="nav-wrapper" aria-label="Page navigation"> - <!-- Mobile navigation buttons --> - - - - <a rel="next" href="git.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right"> - <i class="fa fa-angle-right"></i> - </a> - - - <div style="clear: both"></div> - </nav> - </div> - </div> - - <nav class="nav-wide-wrapper" aria-label="Page navigation"> - - - - <a href="git.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right"> - <i class="fa fa-angle-right"></i> - </a> - - </nav> - - </div> - - - - - - - - - <script type="text/javascript"> - window.playpen_copyable = true; - </script> - - - - - - <script src="elasticlunr.min.js" type="text/javascript" charset="utf-8"></script> - <script src="mark.min.js" type="text/javascript" charset="utf-8"></script> - <script src="searcher.js" type="text/javascript" charset="utf-8"></script> - - - <script src="clipboard.min.js" type="text/javascript" charset="utf-8"></script> - <script src="highlight.js" type="text/javascript" charset="utf-8"></script> - <script src="book.js" type="text/javascript" charset="utf-8"></script> - - <!-- Custom JS scripts --> - - - - - </body> -</html> |