Analysis of an example ELF file static link

Reference:

ELF V1.2

The programmer's self-cultivation, links, "the fourth chapter loading and static link library

Development platform:

[thm@tanghuimin static_link]$ uname -a Linux tanghuimin 2.6.32-358.el6.x86_64 #1 SMP Fri Feb 22 00:31:26 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux 

The 1.ELF file format.

Readelf -h view ELF file header information can see Type three: REL, EXEC, DYN.

The REL file is only be compiled have not been linked to a file, The format of the left a, elf header+section1,2,3...+section header table, Each section corresponds to a section header table entry, Section header table provides an index for each section. Has not been linked files without program header, cannot be loaded into memory operation, readelf -l will prompt"There are no program headers in this file".

The EXEC and DYN files are linked files, the format is the right one, elf header+program header table+segment1,2,3...+section header table. Each segment corresponds to a program header table entry, program header table provides the index for each segment. The EXEC and DYN files with program headers, can be loaded into memory to run readelf -l, you can see a segment is composed of one or more section, Type LOAD segment can be loaded into memory operation, other types of segment provide supplementary information.

The 2 example analysis

(1)Create a file

Create the file common.c

int val = 1; int func(void) { return (val+10); } 

Create the file test.c

extern int val; extern int func(void); int main() {     val = 10;     func(); return 0; } 

(2)Compile

Compile the two file.C

gcc -c test.c

gcc -c common.c

The formation of test.o and common.o belong to REL type

To analyze the compiler generated REL file

(2.1)First have a look test.o:

Readelf -s test.o to view the test.o symbol table

[thm@tanghuimin static_link]$ readelf -s test.o Symbol table '.symtab' contains 11 entries:    Num:    Value          Size Type    Bind   Vis      Ndx Name      0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND      1: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS test.c      2: 0000000000000000     0 SECTION LOCAL  DEFAULT    1      3: 0000000000000000     0 SECTION LOCAL  DEFAULT    3      4: 0000000000000000     0 SECTION LOCAL  DEFAULT    4      5: 0000000000000000     0 SECTION LOCAL  DEFAULT    6      6: 0000000000000000     0 SECTION LOCAL  DEFAULT    7      7: 0000000000000000     0 SECTION LOCAL  DEFAULT    5      8: 0000000000000000    26 FUNC    GLOBAL DEFAULT    1 main      9: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT  UND val 10: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT  UND func

Because Val and func is not defined in test.c, so these two symbols of the Ndx (the symbol is the section index for UND). In order to make the program execution, we hope that in future links can be found in Val and func these two symbols from other files, and determine which of the two symbol address, determine the symbol's address not defined is "relocation"(relocation).

Readelf -S test.o can see the test.o section header table

[thm@tanghuimin static_link]$ readelf test.o -S There are 12 section headers, starting at offset 0x128: Section Headers:   [Nr] Name              Type             Address           Offset        Size              EntSize          Flags  Link  Info  Align   [ 0]                   NULL             0000000000000000  00000000        0000000000000000  0000000000000000           0     0     0   [ 1] .text             PROGBITS         0000000000000000  00000040        000000000000001a  0000000000000000  AX       0     0     4   [ 2] .rela.text        RELA             0000000000000000  00000548        0000000000000030  0000000000000018          10     1     8   [ 3] .data             PROGBITS         0000000000000000  0000005c        0000000000000000  0000000000000000  WA       0     0     4   [ 4] .bss              NOBITS           0000000000000000  0000005c        0000000000000000  0000000000000000  WA       0     0     4   [ 5] .comment          PROGBITS         0000000000000000  0000005c        000000000000002d  0000000000000001  MS       0     0     1   [ 6] .note.GNU-stack   PROGBITS         0000000000000000  00000089        0000000000000000  0000000000000000           0     0     1   [ 7] .eh_frame         PROGBITS         0000000000000000  00000090        0000000000000038  0000000000000000   A       0     0     8   [ 8] .rela.eh_frame    RELA             0000000000000000  00000578        0000000000000018  0000000000000018          10     7     8   [ 9] .shstrtab         STRTAB           0000000000000000  000000c8        0000000000000059  0000000000000000           0     0     1   [10] .symtab           SYMTAB           0000000000000000  00000428        0000000000000108  0000000000000018          11     8     8   [11] .strtab           STRTAB           0000000000000000  00000530        0000000000000016  0000000000000000           0     0     1 Key to Flags:   W (write), A (alloc), X (execute), M (merge), S (strings)   I (info), L (link order), G (group), x (unknown)   O (extra OS processing required) o (OS specific), p (processor specific) 

We focus on rela section.

You can see the rela.text entry description, link=10, info=1, Link was repositioning symbol the symbol table of the section index, Info said the need to be re positioning of the section index, Popular point is, Will some day in the future I know the address of the symbol, Should I put this address to which section writes, Here is the.Text.

Readelf -r test.o can see details in rel section.

[thm@tanghuimin static_link]$ readelf test.o -r Relocation section '.rela.text' at offset 0x548 contains 2 entries:   Offset          Info           Type           Sym. Value    Sym. Name + Addend 000000000006  000900000002 R_X86_64_PC32     0000000000000000 val - 8 00000000000f  000a00000002 R_X86_64_PC32     0000000000000000 func - 4 Relocation section '.rela.eh_frame' at offset 0x578 contains 1 entries:   Offset          Info           Type           Sym. Value    Sym. Name + Addend 000000000020  000200000002 R_X86_64_PC32     0000000000000000 .text + 0 

Offset said the offset of the symbols in the be relocated in section, 4 bytes of the info Index said the symbols in.Symtab, low 4 byte type RE positioning, different methods to calculate the address is not the same as type.

To sum up, all the information we can draw the symbol Val and func:

Relocatable address Val is in the.Text offset 6, linking process in the future, the connector to the Val address written on this position, Val in.Symtab index 9.

Relocatable address func is in the.Text offset is f, the linking process in the future, the connector to the func address written on this position, func in.Symtab a.

Type a relocation, "ELF V1.2" of the fifty-seventh and 93 pages of details.

Here the two symbols of the type R_X86_64_PC32, calculation method of relocatable addresses for S+A-P, which is a symbolic address and the next instruction of offset.

Objdump -S test.o to view the assembly file

[thm@tanghuimin static_link]$ objdump -S test.o test.o:     file format elf64-x86-64 Disassembly of section .text: 0000000000000000 <main>:    0:    55                       push   %rbp    1:    48 89 e5                 mov    %rsp,%rbp    4:    c7 05 00 00 00 00 0a     movl   $0xa,0x0(%rip)        # e <main+0xe>    b:    00 00 00    e:    e8 00 00 00 00           callq  13 <main+0x13>   13:    b8 00 00 00 00           mov    $0x0,%eax   18:    c9                       leaveq   19:    c3                       retq   

You can see the.Text offset 6 four bytes (Val address) for the full 0, four byte at offset f (func address) for the full 0.

(2.2)Come have a look common.o:

Readelf -s view common.o symbol table

......     8: 0000000000000000     4 OBJECT  GLOBAL DEFAULT    3 val      9: 0000000000000000    15 FUNC    GLOBAL DEFAULT    1 func

You can see the Val defined in the index 3.Data, func is defined in the index 1.Text, the two symbols are defined within the common.c file.

Readelf -S see common.o section header table

......[ 2] .rela.text        RELA             0000000000000000  00000528        0000000000000018  0000000000000018          10     1     8 ......

Readelf -r see common.o relocation details

Relocation section '.rela.text' at offset 0x528 contains 1 entries:   Offset          Info           Type           Sym. Value    Sym. Name + Addend 000000000006  000800000002 R_X86_64_PC32     0000000000000000 val – 4 ......

The above information can be derived, need to be re positioning of the symbol is Val, in.Symtab index 8, need to be re positioning of the address is in the.Text offset 6, relocation type for R_X86_64_PC32, namely.Text offset 6 office address is offset Val address and the next instruction.

Objdump -S view common.o files:

......0000000000000000 <func>:    0:    55                       push   %rbp    1:    48 89 e5                 mov    %rsp,%rbp    4:    8b 05 00 00 00 00        mov    0x0(%rip),%eax        # a <func+0xa>    a:    83 c0 0a                 add    $0xa,%eax    d:    c9                       leaveq    e:    c3                       retq 

You can see the offset is four bytes in Section 6 (Val address) for 0, Val to be written at link time.

(3)Link

The two.O files link,

gcc -o test test.o common.o

The test EXEC type

Static link references "overview of programmers self-cultivation" page 101st:

The first step: space and address allocation

Scanning the input object files all, obtain the length, attribute and position of each section of the object file, and the input symbol table all symbol definition and symbol reference collection, unified into a global symbol table. In this step, the linker will get all the input object file length, and combining them, calculated the length and position of each section of the output file after the merger, and mapping relations.

The second step: symbol resolution and relocation

The use of all of the information collected in the first step, the data read from input file, relocations, and symbol resolution and re positioning, adjusting the code address. In fact the second step is the core link process, especially the process of relocation.

Keywords: extraction can be combined, the global symbol table, relocation

Value orientation of test file after the

Readelf -l view test image distribution process in memory:

...... LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000                  0x0000000000000664 0x0000000000000664  R E    200000   LOAD           0x0000000000000668 0x0000000000600668 0x0000000000600668                  0x00000000000001e8 0x00000000000001f8  RW     200000 ......

You can see that the text segment is mapped into the virtual address 0x400000, data segment is mapped into the virtual address 0x600668.

Readelf test -s to view the test symbol table

......   54: 000000000060084c     4 OBJECT  GLOBAL DEFAULT   24 val......57: 0000000000400490    15 FUNC    GLOBAL DEFAULT   13 func......64: 0000000000400474    26 FUNC    GLOBAL DEFAULT   13 main......

Disassembly

objdump -S test > test.S

...... 0000000000400474 <main>: 114   400474:       55                      push   %rbp 115   400475:       48 89 e5                mov    %rsp,%rbp 116   400478:       c7 05 ca 03 20 00 0a    movl   $0xa,0x2003ca(%rip)        # 60084c <val> 117   40047f:       00 00 00 118   400482:       e8 09 00 00 00          callq  400490 <func> 119    :       b8 00 00 00 00          mov    $0x0,%eax 120   40048c:       c9                      leaveq 121   40048d:       c3                      retq 122   40048e:       90                      nop 123   40048f:       90                      nop 124 125 0000000000400490 <func>: 126   400490:       55                      push   %rbp 127   400491:       48 89 e5                mov    %rsp,%rbp 128   400494:       8b 05 b2 03 20 00       mov    0x2003b2(%rip),%eax        # 60084c <val> 129   40049a:       83 c0 0a                add    $0xa,%eax 130   40049d:       c9                      leaveq 131   40049e:       c3                      retq 132   40049f:       90                      nop ...... 

The main function

Address 0x400478:

400478: c7 05 ca 03 20 00 0a movl $0xa,0x2003ca(%rip) # 60084c <val>

%Rip+0x2003ca=0x400482+0x2003ca=0x60084c=val address

Address 0x400482:

118 400482: e8 09 00 00 00 callq 400490 <func>

The instruction next instruction address 0x400487, the address of the 0x400487+0x09=0x400490=func

Func

Address at 0x 400494:

128 400494: 8b 05 b2 03 20 00 mov 0x2003b2(%rip),%eax # 60084c <val>

%Rip+ 0x2003b2= 0x40049a+0x2003b2=0x60084c=val address

The three relocation therefore addresses to offset a symbolic address and instructions, with the relocation types above analysis. 　　

Recommended from our users: Dynamic Network Monitoring from WhatsUp Gold from IPSwitch. Free Download

Posted by Gavin at August 09, 2014 - 11:36 AM