ELF Dynamic Resolution Symbol Process (Revised)

When you call Printf () for the first time, you need to pass 1-> 2-> 3-> 4 to call Printf (), you don't need to be so complicated. As long as you pass (1 )-> (2)

Let's see how to fix GOT [6], but also say how to find the address to be corrected (I used to have some big misunderstandings in this understanding, misleading the place where you mislead :)))

1: Push $ 0x18 when entering the PLT4, the $ 0x18 is the offset of the Printf relocation in Jmprel Section 2: PrintF relocation address is JMPrel $ 0x18 / * ELF32_rel * reloc = jmprel reloc_offset; * / (GDB ) x / 8x 0x8048278 0x180x8048290: 0x08049488 0x00000407 0x53e58955 0x000000e80x80482a0 <_init 8>: 0xc3815b00 0x000011cf 0x001cbb83 0x74000000typedef struct {Elf32_Addr r_offset; Elf32_Word r_info;} Elf32_Rel; printf that is relocatable printf_retloc.r_offset = 0x08049488; printf_retloc.r_info = 0x00000407 Next, look at 0x08049488 (GDB) x 0x080494880x8049488 <_global_offset_table_ 24>: 0x4006804c is also got [6] 3: void * const reel_addr = (void *) (l-> l_addr reeloc-> r_offset); A executable file or a shared goal, Rel_addr is equal to RELOC-> R_OFFSET So Rel_addr = 0x08049488 = got [6]; 4: * Reloc_addr = value; fix Rel_ADDR is GOT [6] as value as value is calculated Refer to the following source code while r_info yet associated with a symbol Elf32_Sym * sym = & SYMTAB [ELF32_R_SYM (reloc-> r_info)]; sym = 0x8048158 0x00000407; typedef struct {Elf32_Word st_name; Elf32_Addr st_value; Elf32_Word st_size; unsigned char st_info ; unsigned char st_other; Elf32_Half st_shndx;} Elf32_Sym; (gdb) x / 10x 0x8048158 0x000004070x804855f: 0x00003a00 0x00008000 0x00000000 0x000069000x804856f: 0x00008000 0x00000000 0x00008300 0x000080000x804857f: 0x00000000 0x0000b700link_map structure as follows: / * Structure describing a loaded shared object The `l_next 'and. `l_prev 'Members Form a chain of all the shared objects loaded at Startup.

THESE DATA STRUCTURES EXIST IN SPACE Used by The Run-Time Dynamic Linker; Modifying The MAY HAVE DISASTROSTROUS RESULTS.

THIS DATA STRUCTURE Might Change In Future, IF Necessary. User-Level Programs Must Avoid Defining Objects of this Type. * / ★★ Glibc dynamic resolution symbol source code (GLIBC 2.1.3 implementation)

.text .globl _dl_runtime_resolve .type _dl_runtime_resolve, @function .align 16_dl_runtime_resolve:.. pushl% eax # Preserve registers otherwise clobbered pushl% ecx pushl% edx movl 16 (% esp),% edx # Copy args pushed by PLT in register Note movl 12 (% ESP),% EAX # That `fixup 'Takes ITS Parameters in Regs. Call fixup # call resolver. Popl% Edx # Get Register Content Back. Popl% ECX XCHGL% EAX, (% ESP) # get% EAX Contents End Store Function Address. Ret $ 8 # jump to function address.

static ElfW (Addr) __attribute__ ((unused)) fixup (# ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS ELF_MACHINE_RUNTIME_FIXUP_ARGS, # endif struct link_map * l, ElfW (Word) reloc_offset) {const ElfW (Sym) * const symtab = (const void *) l-> l_info [Dt_symtab] -> d_un.d_ptr; const char * stratab = (const void *) L-> L_INFO [DT_STRTAB] -> D_un.d_ptr;

Const pltrel * const reel / * Calculation Function Locate Population * / = (Const Void *) (L-> L_INFO [DT_JMPREL] -> D_UN.D_PTR RELOC_OFFSET); / * L-> L_INFO [DT_JMPREL] -> D_UN. D_ptr is the address of JMPREL Section * /

Const Elfw (SYM) * SYM = & SYMTAB [ELFW (R_SYM) (R_SYM) (R_SYM)]; / * Calculation Function SYMTAB Entrance * / VOID * Const REL_ADDR = (Void *) (L-> L_ADDR Reloc-> r_offset) ; / * Redirect the absolute address * / ELFW (addr) Value;

/ * The use of `alloca 'here looks ridiculous but it helps. The goal is to prevent the function from being inlined and thus optimized out. There is no official way to do this so we use this trick. Gcc never inlines functions which use `alloca '. * / alloca (sizeof (int)); / * Sanity Check That We're real loook at a plt relocation. * / assert (ELFW (R_TYPE) (R_TYPE) (R_TYPE) == Elf_machine_jmp_slot); / * Quality check * /

/ * Look up the target symbol. * / Switch (l_info [VersymidX (DT_VERSYM)]! = Null) {default: {const Elfw (HALF) * VERNUM = (const void *) l-> l_info [Versymidx ( DT_VERSYM)] -> D_un.d_ptr; ELFW (HALF) NDX = VERNUM [ELFW (R_SYM) (R_SYM)]; const struct r_found_version * version = & l-> l_versions [ndx];

if (! version-> hash = 0) {value = _dl_lookup_versioned_symbol (strtab sym-> st_name, & sym, l-> l_scope, l-> l_name, version, ELF_MACHINE_JMP_SLOT); break;}} case 0: value = _dl_lookup_symbol ( strtab sym-> st_name, & sym, l-> l_scope, l-> l_name, ELF_MACHINE_JMP_SLOT);} / * At this point the base address value is loaded object * / / * Currently value contains the base load address of the object that defines Sym. Now add in the symbol offset. * /

Value = (SYM? Value SYM-> ST_VALUE: 0); / * The absolute address of the function * /

/ * And now perhaps the relocation addend. * / Value = ELF_MACHINE_PLT_VALUE (L, Reloc, Value); / * Maybe you need to reposition * /

/ * Finally, fix up the plt itself. * / Elf_machine_fixup_plt (l, reloc, rel_addr, value); / * Fix REL_ADDR, generally got [n] * /

Return Value;

static inline Elf32_Addrelf_machine_plt_value (struct link_map * map, const Elf32_Rela * reloc, Elf32_Addr value) {return value reloc-> r_addend;}. / * Fixup a PLT entry to bounce directly to the function at VALUE * / static inline voidelf_machine_fixup_plt (struct link_map * MAP, Const Elf32_rel * reloc, ELF32_ADDR * RELOC_ADDR, ELF32_ADDR VALUE) {* reloc_addr = value;}

Reference:

1.Glibc 2.1.3 SRC2. << ELF file format >> 3. << Cheating the elf Subversive Dynamic Linking to Libraries >> Write by the grugq4.linux dynamic link technology http://www.linuxforum.net/forum/ showflat.php? Cat = & Board = Kstudy & Number = 102793 & page = 1 & view = collapsed & sb = 5 & o = 31 & part = 5.p58-0x04 by Nergal << The advanced return-into-lib (c) exploits> >