migrated runtime-ld.txt

2 files changed, 108 insertions, 0 deletions

diff --git a/src/SUMMARY.md b/src/SUMMARY.md
index cea9f22..eac8dad 100644
--- a/src/SUMMARY.md
+++ b/src/SUMMARY.md
@@ -1,5 +1,6 @@
 # Summary
 
+- [ld.so](./ld.so.md)
 - [git](./git.md)
 - [gdb](./gdb.md)
 - [radare2](./radare2.md)
diff --git a/src/ld.so.md b/src/ld.so.md
new file mode 100644
index 0000000..6dc8c49
--- /dev/null
+++ b/src/ld.so.md
@@ -0,0 +1,107 @@
+# ld.so(8)
+
+## Environment variables
+```console
+  LD_PRELOAD=<l_so>       colon separated list of libso's to be pre loaded
+  LD_DEBUG=<opts>         comman separated list of debug options
+          =help           list available options
+          =libs           show library search path
+          =files          processing of input files
+          =symbols        show search path for symbol lookup
+          =bindings       show against which definition a symbol is bound
+```
+
+## LD_PRELOAD load & init order
+```markdown
+  > ldd ./main
+    >> libc.so.6 => /usr/lib/libc.so.6
+
+  > LD_PRELOAD=liba.so:libb.so ./main
+             -->
+      preloaded in this order
+             <--
+      initialized in this order
+
+  - preload order determines the order libs are inserted into the link map
+
+  - resulting link map:
+      +------+    +------+    +------+    +------+
+      | main | -> | liba | -> | libb | -> | libc |
+      +------+    +------+    +------+    +------+
+
+  - see preload and init order in action
+    > LD_DEBUG=files LD_PRELOAD=liba.so:libb.so ./main
+      # load order (-> determines link map)
+      >> file=liba.so [0];  generating link map
+      >> file=libb.so [0];  generating link map
+      >> file=libc.so.6 [0];  generating link map
+
+      # init order
+      >> calling init: /usr/lib/libc.so.6
+      >> calling init: <path>/libb.so
+      >> calling init: <path>/liba.so
+      >> initialize program: ./main
+
+  - see the symbol lookup in action and therefore the link map order
+    > LD_DEBUG=symbols,bindings LD_PRELOAD=liba.so:libb.so ./main
+      >> symbol=memcpy;  lookup in file=./main [0]
+      >> symbol=memcpy;  lookup in file=<path>/liba.so [0]
+      >> symbol=memcpy;  lookup in file=<path>/libb.so [0]
+      >> symbol=memcpy;  lookup in file=/usr/lib/libc.so.6 [0]
+      >> binding file ./main [0] to /usr/lib/libc.so.6 [0]: normal symbol
+         `memcpy' [GLIBC_2.14]
+```
+
+
+## dynamic linking (x86_64)
+```makrdown
+  - dynamic linking basically works via one indirect jump. It uses a
+    combination of function trampolines (.plt) and a function pointer table
+    (.got.plt). On the first call the trampoline sets up some metadata and
+    then jumps to the ld.so runtime resolve function, which in turn patches
+    the table with the correct function pointer.
+      .plt ....... contains function trampolines, usually located in code
+                   segment (rx permission)
+      .got.plt ... hold the function pointer table
+
+  - following r2 dump shows this
+      - [0x00401030] indirect jump for 'puts' using function pointer in
+        _GLOBAL_OFFSET_TABLE_[3]
+      - initially points to instruction behind 'puts' trampoline [0x00401036]
+      - this pushes relocation index and then jumps to the first trampoline
+        [0x00401020]
+      - the first trampoline jumps to _GLOBAL_OFFSET_TABLE_[2] which will be
+        filled at program startup by the ld.so with its resolve function
+      - the resolve function fixes the relocation referenced by the
+        relocation index pushed by the 'puts' trampoline
+      - the relocation entry tells the resolve function which symbol to
+        search for and where to put the function pointer
+          > readelf -r <main>
+            >> Relocation section '.rela.plt' at offset 0x4b8 contains 1 entry:
+            >>   Offset          Info           Type           Sym. Value    Sym. Name + Addend
+            >> 000000404018  000200000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0
+          - offset points to _GLOBAL_OFFSET_TABLE_[3]
+
+      [0x00401040]> pd 4 @ section..got.plt
+                  ;-- section..got.plt:
+                  ;-- .got.plt:    ; [22] -rw- section size 32 named .got.plt
+                  ;-- _GLOBAL_OFFSET_TABLE_:
+                  0x00404000      .qword 0x0000000000403e10 ; section..dynamic ; obj._DYNAMIC
+                  0x00404008      .qword 0x0000000000000000
+                  ; CODE XREF from section..plt @ +0x6
+                  0x00404010      .qword 0x0000000000000000
+                  ;-- reloc.puts:
+                  ; CODE XREF from sym.imp.puts @ 0x401030
+                  0x00404018      .qword 0x0000000000401036                  ; RELOC 64 puts
+
+      [0x00401040]> pd 6 @ section..plt
+                  ;-- section..plt:
+                  ;-- .plt:       ; [12] -r-x section size 32 named .plt
+              ┌─> 0x00401020      ff35e22f0000   push qword [0x00404008]
+              ╎   0x00401026      ff25e42f0000   jmp qword [0x00404010]
+              ╎   0x0040102c      0f1f4000       nop dword [rax]
+      ┌ 6: int sym.imp.puts (const char *s);
+      └       ╎   0x00401030      ff25e22f0000   jmp qword [reloc.puts]
+              ╎   0x00401036      6800000000     push 0
+              └─< 0x0040103b      e9e0ffffff     jmp sym..plt
+```