Homeland Project Welcome home 家園計劃 歡迎回家

Code: Select all

// t.c
#include <stdio.h>  // printf
#include <unistd.h>  // sleep

int main(int argc, char *argv[]) {
	printf("Hello World!\n");  // 调用write(...)
	sleep(-1);  // 表示一直阻塞
}

// gcc -o file t.c

Code: Select all

$ ./file &
[1] 748098
$ Hello World!
cat /proc/748098/maps
# 可执行文件虚拟空间映射
561c05d55000-561c05d56000 r--p 00000000 fc:01 1058139  /root/file
# 堆区虚拟空间映射
561c07aaa000-561c07acb000 rw-p 00000000 00:00 0        [heap]
# 动态链接器虚拟空间映射
7fd564277000-7fd564299000 r--p 00000000 fc:01 1705537  /usr/lib/x86_64-linux-gnu/libc-2.31.so
# 栈区虚拟空间映射
7ffcb0418000-7ffcb0439000 rw-p 00000000 00:00 0        [stack]

Code: Select all

$ objdump -h file

.got   00000050  0000000000003fb0  0000000000003fb0  00002fb0  2**3
        CONTENTS, ALLOC, LOAD, DATA

Code: Select all

$ objdump -R file

DYNAMIC RELOCATION RECORDS
OFFSET           TYPE              VALUE 
0000000000003fc8 R_X86_64_JUMP_SLOT  puts@GLIBC_2.2.5
0000000000003fd0 R_X86_64_JUMP_SLOT  sleep@GLIBC_2.2.5

Code: Select all

    readelf -d xxx.so | grep TEXTREL

Code: Select all

extern int global;

int foo() {
	global = 1;
}

Code: Select all

function@plt:
	# 如果GOT已经存在该函数地址，则直接跳转，否则该项中的地址是该指令的下一条指令，即push n
	jmp *(function@GOT)
	# 这个数字是该符号在.rel.plt中的下标
	push n
	# 模块id入栈
	push moduleID
	jump _dl_runtime_resolve

Code: Select all

0000000000001169 <main>:
	...
	1178:	e8 e3 fe ff ff       	callq  1060 <puts@plt>
	...
0000000000001060 <puts@plt>:
    1064:	f2 ff 25 5d 2f 00 00 	bnd jmpq *0x2f5d(%rip)        
    106b:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)

Code: Select all

Contents of section .interp:
 0318 2f6c6962 36342f6c 642d6c69 6e75782d  /lib64/ld-linux-
 0328 7838362d 36342e73 6f2e3200           x86-64.so.2.

Code: Select all

readelf -l a.out | grep interpreter

[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]

Code: Select all

/* Dynamic section entry.  */

typedef struct
{
  Elf32_Sword   d_tag;                  /* Dynamic entry type */
  union
    {
      Elf32_Word d_val;                 /* Integer value */
      Elf32_Addr d_ptr;                 /* Address value */
    } d_un;
} Elf32_Dyn;

Code: Select all

$ readelf -d file

Dynamic section at offset 0x2dc0 contains 27 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000c (INIT)               0x1000
 0x000000000000000d (FINI)               0x1208
 0x0000000000000019 (INIT_ARRAY)         0x3db0
 0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x3db8
 0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x3a0
 0x0000000000000005 (STRTAB)             0x488
 0x0000000000000006 (SYMTAB)             0x3c8
 0x000000000000000a (STRSZ)              136 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x3fb0
 0x0000000000000002 (PLTRELSZ)           48 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x600
 0x0000000000000007 (RELA)               0x540
 0x0000000000000008 (RELASZ)             192 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000006ffffffe (VERNEED)            0x520
 0x000000006fffffff (VERNEEDNUM)         1
 0x000000006ffffff0 (VERSYM)             0x510
 0x000000006ffffff9 (RELACOUNT)          3
 0x0000000000000000 (NULL)               0x0

Code: Select all

$ ldd file
	# 系统调用库
	linux-vdso.so.1 (0x00007ffd11337000)
	# GNU C库
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcc4edc3000)
	# 动态链接库
	/lib64/ld-linux-x86-64.so.2 (0x00007fcc4efc4000)

Code: Select all

Symbol table '.symtab' contains 66 entries:
   Num:    Value          Size Type    Bind   Vis      Ndx Name
    # puts函数，是一个UND(undefined)状态
    49: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND puts@@GLIBC_2.2.5
    61: 0000000000001169    37 FUNC    GLOBAL DEFAULT   16 main
    64: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND sleep@@GLIBC_2.2.5

Symbol table of '.gnu.hash' for image:
  Num Buc:    Value          Size   Type   Bind Vis      Ndx Name
    7   0: 0000000000000000     0 FUNC    WEAK   DEFAULT UND __cxa_finalize

Code: Select all

$ readelf -r file

Relocation section '.rela.dyn' at offset 0x540 contains 8 entries:
  Offset          Info           Type           Sym. Value    Sym. Name + Addend
000000003db0  000000000008 R_X86_64_RELATIVE                    1160
000000003db8  000000000008 R_X86_64_RELATIVE                    1120
000000004008  000000000008 R_X86_64_RELATIVE                    4008
000000003fd8  000100000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_deregisterTMClone + 0
000000003fe0  000300000006 R_X86_64_GLOB_DAT 0000000000000000 __libc_start_main@GLIBC_2.2.5 + 0
000000003fe8  000400000006 R_X86_64_GLOB_DAT 0000000000000000 __gmon_start__ + 0
000000003ff0  000500000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_registerTMCloneTa + 0
000000003ff8  000700000006 R_X86_64_GLOB_DAT 0000000000000000 __cxa_finalize@GLIBC_2.2.5 + 0

Relocation section '.rela.plt' at offset 0x600 contains 2 entries:
  Offset          Info           Type           Sym. Value    Sym. Name + Addend
# 两个共享对象函数引用
000000003fc8  000200000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0
000000003fd0  000600000007 R_X86_64_JUMP_SLO 0000000000000000 sleep@GLIBC_2.2.5 + 0

Code: Select all

0000000000001060 <puts@plt>:
    1064:	f2 ff 25 5d 2f 00 00 	bnd jmpq *0x2f5d(%rip) # 3fc8 <puts@GLIBC_2.2.5>      
    106b:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)

Code: Select all

typedef struct
{
  uint32_t a_type;              /* Entry type */
  union
    {
      uint32_t a_val;           /* Integer value */
      /* We use to have pointer elements added here.  We cannot do that,
         though, since it does not work when using 32-bit definitions
         on 64-bit platforms and vice versa.  */
    } a_un;
} Elf32_auxv_t;

Code: Select all

PROVIDE (__executable_start = SEGMENT_START("text-segment", 0x400000)); . = SEGMENT_START("text-segment", 0x400000) + SIZEOF_HEADERS;
PROVIDE (__etext = .);
PROVIDE (_etext = .);
PROVIDE (etext = .);
_edata = .; PROVIDE (edata = .);
_end = .; PROVIDE (end = .);

Code: Select all

#include <stdio.h>

extern char __executable_start[];
extern char __etext[];
extern char _edata[];
extern char _end[];

int main(int argc, char *argv[]) {
    printf("%X.\n", __executable_start);
    printf("%X.\n", __etext);
    printf("%X.\n", _edata);
    printf("%X.\n", _end);
}

/*
	B0926000.
	B0927255.
	B092A010.
	B092A018.
*/

Code: Select all

// filename 被加载动态库的路径
// flag 符号的解析方式
void *dlopen(const char *filename, int flags);

Code: Select all

// handle 句柄
// symbol 函数名
void *dlsym(void *handle, const char *symbol);

Code: Select all

char *dlerror(void);

Code: Select all

#include <stdio.h>
#include <dlfcn.h>

int main(int argc, char *argv[]) {
    void *handle;
    double (*func)(double);
    char *error;

    handle = dlopen(argv[1], RTLD_NOW);
    if (handle == NULL) {
        printf("open library %s error: %s.\n", argv[1], dlerror());
        return -1;
    }
    func = dlsym(handle, "sin");
    if ((error = dlerror()) != NULL) {
        printf("symbal sin not found: %s.\n", error);
        return -1;
        // goto exit_runso;
    }
    printf("%f.\n", func(3.1415926 / 2));
    // exit_runso;
    dlclose(handle);
}