diff options
| -rw-r--r-- | runtime-ld.txt | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/runtime-ld.txt b/runtime-ld.txt index 86fe9ad..7c7a5b8 100644 --- a/runtime-ld.txt +++ b/runtime-ld.txt @@ -5,6 +5,7 @@ ------ |ld_so| |load_init_order| + |dynamic_linking| # ld.so(8) *ld_so* =========== @@ -57,6 +58,58 @@ >> binding file ./main [0] to /usr/lib/libc.so.6 [0]: normal symbol `memcpy' [GLIBC_2.14] + ## dynamic linking (x86_64) *dynamic_linking* + - dynamic linking basically works via one indirect jump. It uses a + combination of function trampolines (.plt) and a function pointer table + (.got.plt). On the first call the trampoline sets up some metadata and + then jumps to the ld.so runtime resolve function, which in turn patches + the table with the correct function pointer. + .plt ....... contains function trampolines, usually located in code + segment (rx permission) + .got.plt ... hold the function pointer table + + - following r2 dump shows this + - [0x00401030] indirect jump for 'puts' using function pointer in + _GLOBAL_OFFSET_TABLE_[3] + - initially points to instruction behind 'puts' trampoline [0x00401036] + - this pushes relocation index and then jumps to the first trampoline + [0x00401020] + - the first trampoline jumps to _GLOBAL_OFFSET_TABLE_[2] which will be + filled at program startup by the ld.so with its resolve function + - the resolve function fixes the relocation referenced by the + relocation index pushed by the 'puts' trampoline + - the relocation entry tells the resolve function which symbol to + search for and where to put the function pointer + > readelf -r <main> + >> Relocation section '.rela.plt' at offset 0x4b8 contains 1 entry: + >> Offset Info Type Sym. Value Sym. Name + Addend + >> 000000404018 000200000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0 + - offset points to _GLOBAL_OFFSET_TABLE_[3] + + [0x00401040]> pd 4 @ section..got.plt + ;-- section..got.plt: + ;-- .got.plt: ; [22] -rw- section size 32 named .got.plt + ;-- _GLOBAL_OFFSET_TABLE_: + 0x00404000 .qword 0x0000000000403e10 ; section..dynamic ; obj._DYNAMIC + 0x00404008 .qword 0x0000000000000000 + ; CODE XREF from section..plt @ +0x6 + 0x00404010 .qword 0x0000000000000000 + ;-- reloc.puts: + ; CODE XREF from sym.imp.puts @ 0x401030 + 0x00404018 .qword 0x0000000000401036 ; RELOC 64 puts + + [0x00401040]> pd 6 @ section..plt + ;-- section..plt: + ;-- .plt: ; [12] -r-x section size 32 named .plt + ┌─> 0x00401020 ff35e22f0000 push qword [0x00404008] + ╎ 0x00401026 ff25e42f0000 jmp qword [0x00404010] + ╎ 0x0040102c 0f1f4000 nop dword [rax] + ┌ 6: int sym.imp.puts (const char *s); + └ ╎ 0x00401030 ff25e22f0000 jmp qword [reloc.puts] + ╎ 0x00401036 6800000000 push 0 + └─< 0x0040103b e9e0ffffff jmp sym..plt + + -------------------------------------------------------------------------------- vim:sts=2:et:tw=80:cc=80:fo+=t:ft=help |