elf-02 overlap 与 dynamic

瞎折腾: https://github.com/ljqaq233/labs

HobbyOS: https://github.com/ljqaq233/textos-dev

layout: center¶

overlap¶

zoom: 0.7 layout: two-cols

::right::

需要构造如图左所示的 overlap 的结构

overlap: 不是一个专有的术语, 这里是我用于指代 - 经过对齐后, 前一个段的尾部与下一个段的头部重合的情况

构造两个段, 使得它们 overlap
段所在的页中与页尾放两个 long 值
程序读出 long 查看数据是否正确来验证是否正确加载

````md magic-move

println:
  /* ... */

  .text
  .global _start
_start:
  mov int1, %rdi
  call println

  mov int2, %rdi
  call println

  movq $60, %rax
  xorq %rdi, %rdi
  syscall

  .data
int1: .quad 123456789
int2: .quad 987654321

println:
  /* ... */

  .text
  .global _start
_start:
  mov int1, %rdi
  call println

  mov int2, %rdi
  call println

  movq $60, %rax
  xorq %rdi, %rdi
  syscall

  .section .d1, "aw"
int1: .quad 123456789
  .section .d2, "aw"
int2: .quad 987654321

::right::

<div v-click="2" style="font-size: 14px;">

`aw`: 
  - `a` = allocatable (loaded into memory at runtime)
  - `w` = writable (can be written during execution)

</div>

<div v-click="3">

只有带 A (`SHF_ALLOC`, 即 Allocable) 标志的 **section** 才会被映射或加载到内存中, 通常被归入 `PT_LOAD` (这里即被归为 `PT_LOAD`)

</div>

<!--
这是一个 简单的汇编, 折叠的 println 是 打印整数, 入口在这里, 然后定义了两个 quad (long long int / 64 位数)
2: 把它放到两个 section 中
3, 4: aw: 照着念
-->

---

`same-page.ld`

<<< ./snippets/2-1.ld c {*|5|6|8,9,11|7,10|*}

<div v-click="1">

- `.` (dot): Location counter, 记录当前输出位置 (虚拟地址)
  - `. = 0x400000` (4MiB), 下一节 (`.text`) 也就会被 加载到 4MiB 的位置

</div>

<div v-click="2">

- `.text : { *(.text) }` 合并 来自 `*` 的文件的 `.text` 节 到最终可执行文件的 `.text` 节

</div>


<div v-click="3">

- `.data : ` 收集 `.d1` 与 `.d2` 合并到 `.data` 节

</div>

<div v-click="4">

- `. = xxx;` 将 `location counter` 抬升, 使得 两个 `long` 存放在指定位置

</div>

<!--
以上只是设置了 section 名字, 没有用上 这些 section, 尽管它们会进入 PT_LOAD, 这些section 肯定是不会 组成我们所希望的 elf, 所以就需要写链接器脚本
-->

---
layout: two-cols
layoutClass: gap-02
---

<style>
.slidev-layout.two-columns {
  grid-template-columns: 40% 60%;
}
.slidev-layout {
  padding: 1rem 1rem;
}
</style>

````md magic-move {at: '2'}
<<< ./snippets/2-1.ld c
<<< ./snippets/2-2.ld c
<<< ./snippets/2-3.ld c {*|4,5|*}
<<< ./snippets/2-3.ld c
<<< ./snippets/2-4.ld c {5,13|*}

gcc same-page.S -nostdlib -T same-page.ld -static

::right::

现在的状态 (示意图):

::right::

Program Headers:
  Type  Offset      VirtAddr       PhysAddr
        FileSiz     MemSiz          Flags  Align
  LOAD  0x000001000 0x000000400000 0x0000000000400000
        0x0000000a8 0x0000000000a8  R E    0x1000
  LOAD  0x000002000 0x000000401000 0x0000000000401000
        0x000000008 0x000000000008  R      0x1000
  LOAD  0x000002800 0x000000401800 0x0000000000401800
        0x000000008 0x000000000008  R      0x1000

类似于 "对等映射" 的状态

内存中两个段的 相对关系 与文件中并无差别

也就是说, 无论是将 LOAD1 / LOAD2 给加载到内存中, 由于向下对齐, 两个 segment 都会被正确加载, 因为它们在文件中处于相同的页面, 且反应了 "真实的地址空间"

如果有差别, 会发生什么, 也就是打乱 "对等映射"

zoom: 0.68¶

从一个不可控的方式说起¶

HACK

````md magic-move <<< ./snippets/2-4.ld c <<< ./snippets/same-page.ld c

::right::

<v-clicks>

这样会将 `.d2` 放到 `p_offset = 0x800` 的位置

至于为什么不可控:

- `AT` 用于设置 `PhysAddr`
- 这里 **也许** 是利用了 `AT` 的副作用

顺带一提, 对于 `p_align` 的标准定义:

> Loadable process segments must have congruent values for p_vaddr and
p_offset, modulo the page size.This member gives the value to which the
segments are aligned in memory and in the file.

> 简而言之, `p_vaddr % p_align == p_offset % p_align`

可能是这一个副作用导致的

</v-clicks>

---

### 无论如何

都获得了一个 不常规的, "overlap" 的 ELF `⊂((・▽・))⊃`

```go
Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  LOAD           0x0000000000001000 0x0000000000400000 0x0000000000400000
                 0x00000000000000a8 0x00000000000000a8  R E    0x1000
  LOAD           0x0000000000002000 0x0000000000401000 0x0000000000401000
                 0x0000000000000008 0x0000000000000008  R      0x1000
  LOAD           0x0000000000000800 0x0000000000401800 0x0000000000000808
                 0x0000000000000008 0x0000000000000008  R      0x1000
```

<v-click>

```
$ ./a.out
282584257676671
987654321
```

获得一个一个不常规的值, 但它却不是 垃圾数据, 可以猜一下它是什么

无论 **被 linux kernel 加载, 运行情况如何**, 我们可以 **尝试** 正确处理这个 overlap

</v-click>

---
layout: two-cols
layoutClass: gap-02
---

<style>

.slidev-layout.two-columns {
  grid-template-columns: 59% 40%;
}
.slidev-layout {
  padding: 0 0;
}

</style>

````md magic-move {at:'1'}
```c
int main(int argc, char *argv[]) {
  // ...
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    Elf64_Phdr *phdr = cast(Elf64_Phdr *, phdrs + i * ehdr->e_phentsize);
    if (phdr->p_type != PT_LOAD)
      continue;
    int prot = 0;
    if (phdr->p_flags & PF_R)
      prot |= PROT_READ;
    if (phdr->p_flags & PF_W)
      prot |= PROT_WRITE;
    if (phdr->p_flags & PF_X)
      prot |= PROT_EXEC;
    size_t A = phdr->p_align;
    size_t foff = align_dn(phdr->p_offset, A);
    size_t fend = align_up(phdr->p_offset + phdr->p_filesz, A);
    size_t fsize = fend - foff;
    size_t moff = align_dn(phdr->p_vaddr, A);
    size_t mend = align_up(phdr->p_vaddr + phdr->p_memsz, A);
    size_t msize = mend - moff;

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c
int main(int argc, char *argv[]) {
  // ...
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    Elf64_Phdr *phdr = cast(Elf64_Phdr *, phdrs + i * ehdr->e_phentsize);
    if (phdr->p_type != PT_LOAD)
      continue;
    int prot = 0;
    if (phdr->p_flags & PF_R)
      prot |= PROT_READ;
    if (phdr->p_flags & PF_W)
      prot |= PROT_WRITE;
    if (phdr->p_flags & PF_X)
      prot |= PROT_EXEC;
    size_t A = phdr->p_align;
    size_t foff = align_dn(phdr->p_offset, A);
    size_t fend = align_up(phdr->p_offset + phdr->p_filesz, A);
    size_t fsize = fend - foff;
    size_t moff = align_dn(phdr->p_vaddr, A);
    size_t mend = align_up(phdr->p_vaddr + phdr->p_memsz, A);
    size_t msize = mend - moff;
    if (prev_mend > moff) {
      // handle overlap
    }

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c
int main(int argc, char *argv[]) {
  // ...
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    // ...
    size_t A = phdr->p_align;
    size_t foff = align_dn(phdr->p_offset, A);
    size_t fend = align_up(phdr->p_offset + phdr->p_filesz, A);
    size_t fsize = fend - foff;
    size_t moff = align_dn(phdr->p_vaddr, A);
    size_t mend = align_up(phdr->p_vaddr + phdr->p_memsz, A);
    size_t msize = mend - moff;
    if (prev_mend > moff) {
      // handle overlap
      size_t overlapped = prev_mend - moff;
      msize -= overlapped, moff += overlapped;
      fsize -= overlapped, foff += overlapped;
    }

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c
int main(int argc, char *argv[]) {
  // ...
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    // ...
    size_t A = phdr->p_align;
    size_t foff = align_dn(phdr->p_offset, A);
    size_t fend = align_up(phdr->p_offset + phdr->p_filesz, A);
    size_t fsize = fend - foff;
    size_t moff = align_dn(phdr->p_vaddr, A);
    size_t mend = align_up(phdr->p_vaddr + phdr->p_memsz, A);
    size_t msize = mend - moff;
    if (prev_mend > moff) {
      // handle overlap
      size_t overlapped = prev_mend - moff;
      msize -= overlapped, moff += overlapped;
      fsize -= overlapped, foff += overlapped;
      ssize_t readsz = foff - phdr->p_offset;
      ssize_t readoff = moff - phdr->p_vaddr;
      if (readsz > phdr->p_filesz)
        readsz = phdr->p_filesz;
      assert(readsz >= 0 && readoff >= 0); // I'm sure
      lseek(fd, phdr->p_offset, SEEK_SET);
      read(fd, virt + phdr->p_vaddr, readsz);
    }

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c {*|17|*}
int main(int argc, char *argv[]) {
  // ...
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    // ...
    if (prev_mend > moff) {
      // handle overlap
      size_t overlapped = prev_mend - moff;
      msize -= overlapped, moff += overlapped;
      fsize -= overlapped, foff += overlapped;
      ssize_t readsz = foff - phdr->p_offset;
      ssize_t readoff = moff - phdr->p_vaddr;
      if (readsz > phdr->p_filesz)
        readsz = phdr->p_filesz;
      assert(readsz >= 0 && readoff >= 0); // I'm sure
      lseek(fd, phdr->p_offset, SEEK_SET);
      read(fd, virt + phdr->p_vaddr, readsz);
    }

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c
int main(int argc, char *argv[]) {
  // ...
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    // ...
    if (prev_mend > moff) {
      // handle overlap
      size_t orig_moff = moff;
      size_t overlapped = prev_mend - moff;
      msize -= overlapped, moff += overlapped;
      fsize -= overlapped, foff += overlapped;
      ssize_t readsz = foff - phdr->p_offset;
      ssize_t readoff = moff - phdr->p_vaddr;
      if (readsz > phdr->p_filesz)
        readsz = phdr->p_filesz;
      assert(readsz >= 0 && readoff >= 0); // I'm sure
      if (!(prev_prot & PROT_WRITE))
        mprotect(cast(void *, orig_moff), overlapped, prev_prot | PROT_WRITE);
      lseek(fd, phdr->p_offset, SEEK_SET);
      read(fd, virt + phdr->p_vaddr, readsz);
      if (!(prev_prot & PROT_WRITE) && !(phdr->p_flags & PF_W))
        mprotect(cast(void *, orig_moff), overlapped, prev_prot);
    }

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c
int main(int argc, char *argv[]) {
  // ...
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    // ...
    if (prev_mend > moff) {
      // handle overlap
      size_t orig_moff = moff;
      size_t overlapped = prev_mend - moff;
      msize -= overlapped, moff += overlapped;
      fsize -= overlapped, foff += overlapped;
      ssize_t readsz = foff - phdr->p_offset;
      ssize_t readoff = moff - phdr->p_vaddr;
      if (readsz > phdr->p_filesz)
        readsz = phdr->p_filesz;
      assert(readsz >= 0 && readoff >= 0); // I'm sure
      if (!(prev_prot & PROT_WRITE))
        mprotect(cast(void *, orig_moff), overlapped, prev_prot | PROT_WRITE);
      lseek(fd, phdr->p_offset, SEEK_SET);
      read(fd, virt + phdr->p_vaddr, readsz);
      if ((prev_prot & prot) != prot ||
          !(prev_prot & PROT_WRITE) && !(phdr->p_flags & PF_W))
        mprotect(cast(void *, orig_moff), overlapped, prev_prot | prot);
    }

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c
int main(int argc, char *argv[]) {
  // ...
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  size_t prev_mend = 0;
  size_t prev_prot = 0;
  for (int i = 0; i < ehdr->e_phnum; i++) {
    // ...
    if (prev_mend > moff) {
      // handle overlap
      size_t orig_moff = moff;
      size_t overlapped = prev_mend - moff;
      msize -= overlapped, moff += overlapped;
      fsize -= overlapped, foff += overlapped;
      ssize_t readsz = foff - phdr->p_offset;
      ssize_t readoff = moff - phdr->p_vaddr;
      if (readsz > phdr->p_filesz)
        readsz = phdr->p_filesz;
      assert(readsz >= 0 && readoff >= 0); // I'm sure
      if (!(prev_prot & PROT_WRITE))
        mprotect(cast(void *, orig_moff), overlapped, prev_prot | PROT_WRITE);
      lseek(fd, phdr->p_offset, SEEK_SET);
      read(fd, virt + phdr->p_vaddr, readsz);
      if (!(prev_prot & PROT_WRITE) && !(phdr->p_flags & PF_W))
        mprotect(cast(void *, orig_moff), overlapped, prev_prot);
    }
    prev_mend = mend;
    prev_prot = prot;

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c {*|9,10,19|*}
int main(int argc, char *argv[]) {
  // ...
  for (int i = 0; i < ehdr->e_phnum; i++) {
    // ...
    if (prev_mend > moff) {
      // handle overlap
      size_t orig_moff = moff;
      size_t overlapped = prev_mend - moff;
      msize -= overlapped, moff += overlapped;
      fsize -= overlapped, foff += overlapped;
      // do read
    }
    prev_mend = mend;
    prev_prot = prot;

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
    assert(area == exp);
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```
```c
int main(int argc, char *argv[]) {
  // ...
  for (int i = 0; i < ehdr->e_phnum; i++) {
    // ...
    if (prev_mend > moff) {
      // handle overlap
      size_t orig_moff = moff;
      size_t overlapped = prev_mend - moff;
      msize -= overlapped, moff += overlapped;
      fsize -= overlapped, foff += overlapped;
      // do read
    }
    prev_mend = mend;
    prev_prot = prot;

    void *exp = cast(void *, moff);
    printf("  map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize,
           msize);
    if (fsize) {
      void *area = mmap(exp, fsize, prot, MAP_PRIVATE | MAP_FIXED, fd, foff);
      assert(area == exp);
    }
  }
  void *start = cast(void *, ehdr->e_entry);
  printf("start is at %p\n", start);
  asm volatile("jmp *%0\n" ::"r"(start) : "memory");
  __builtin_unreachable();
}
```

::right::

layout: center¶

dynamic¶

实现 dynamic 之后, 可以加载 static-pie 链接的程序

这是最基本, 最粗浅的目标.

简而言之:

寻找一个 virtual memory base address (以下简写 virt)
逐段加载到 virt

注意:

ET_DYN 的放行

问题:

分配 elf 需要的内存用 mmap
但是, 如果随便选择一个地址, 无法确保这个区域 (这一大块连续虚拟内存) 内的页都为我们所用
而且, 在不访问 /proc/self 的情况下, 了解地址空间有困难
所以, 还是交给 mmap 比较不错

那么怎么一开始就薅到一块连续的内存, 保证它之后只为我们所用呢?

在 manual 中:

┌───────────────────┬──────────────────────────┐
│ Symbolic Constant │       Description        │
├───────────────────┼──────────────────────────┤
│ PROT_READ         │ Data can be read.        │
│ PROT_WRITE        │ Data can be written.     │
│ PROT_EXEC         │ Data can be executed.    │
│ PROT_NONE         │ Data cannot be accessed. │
└───────────────────┴──────────────────────────┘

用这个权限可以让它看似已经分配, 却没有实际用上

而且 mmap 有懒分配的机制, 加上这个权限, 不用当心浪费内存

When MAP_FIXED is set in the flags argument, the implementation is informed that the value of pa shall be addr, exactly. If MAP_FIXED is set, mmap() may return MAP_FAILED and set errno to [EINVAL]. If a MAP_FIXED request is successful, then any previous mappings or memory locks for those whole pages con‐taining any part of the address range [pa,pa+len) shall be removed, as if by an appropriate call to munmap(), before the new mapping is established.

where: pa is the address at which the mapping was placed (pa)

用这个试试?

md magic-move

  // ... open and do mmap
  Elf64_Ehdr *ehdr = cast(Elf64_Ehdr *, base);
  assert(ehdr->e_ident[0] == ELFMAG0);
  assert(ehdr->e_ident[1] == ELFMAG1);
  assert(ehdr->e_ident[2] == ELFMAG2);
  assert(ehdr->e_ident[3] == ELFMAG3);
  assert(ehdr->e_type == ET_EXEC);
  assert(ehdr->e_machine == EM_X86_64);

  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  int is_overlapped = 0;
  size_t prev_mend = 0;
  size_t prev_prot = 0;
  for (int i = 0; i < ehdr->e_phnum; i++) {
  // ... load and start


 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15   // ... open and do mmap
  Elf64_Ehdr *ehdr = cast(Elf64_Ehdr *, base);
  assert(ehdr->e_ident[0] == ELFMAG0);
  assert(ehdr->e_ident[1] == ELFMAG1);
  assert(ehdr->e_ident[2] == ELFMAG2);
  assert(ehdr->e_ident[3] == ELFMAG3);
  assert(ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN);
  assert(ehdr->e_machine == EM_X86_64);

  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  int is_overlapped = 0;
  size_t prev_mend = 0;
  size_t prev_prot = 0;
  for (int i = 0; i < ehdr->e_phnum; i++) {
  // ... load and start

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28   // ... open and do mmap
  Elf64_Ehdr *ehdr = cast(Elf64_Ehdr *, base);
  assert(ehdr->e_ident[0] == ELFMAG0);
  assert(ehdr->e_ident[1] == ELFMAG1);
  assert(ehdr->e_ident[2] == ELFMAG2);
  assert(ehdr->e_ident[3] == ELFMAG3);
  assert(ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN);
  assert(ehdr->e_machine == EM_X86_64);

  intptr_t lp_max = 0;
  intptr_t lp_min = -1;
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    Elf64_Phdr *phdr = cast(Elf64_Phdr *, phdrs + i * ehdr->e_phentsize);
    if (phdr->p_type == PT_LOAD) {
      uintptr_t dptr = align_dn(phdr->p_vaddr, phdr->p_align);
      uintptr_t uptr = align_up(phdr->p_vaddr + phdr->p_memsz, phdr->p_align);
      if (dptr < lp_min)
        lp_min = dptr;
      if (uptr > lp_max)
        lp_max = uptr;
    }
  }
  int is_overlapped = 0;
  size_t prev_mend = 0;
  size_t prev_prot = 0;
  for (int i = 0; i < ehdr->e_phnum; i++) {
  // ... load and start

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30   // ... open and do mmap
  Elf64_Ehdr *ehdr = cast(Elf64_Ehdr *, base);
  assert(ehdr->e_ident[0] == ELFMAG0);
  assert(ehdr->e_ident[1] == ELFMAG1);
  assert(ehdr->e_ident[2] == ELFMAG2);
  assert(ehdr->e_ident[3] == ELFMAG3);
  assert(ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN);
  assert(ehdr->e_machine == EM_X86_64);

  intptr_t lp_max = 0;
  intptr_t lp_min = -1;
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  for (int i = 0; i < ehdr->e_phnum; i++) {
    Elf64_Phdr *phdr = cast(Elf64_Phdr *, phdrs + i * ehdr->e_phentsize);
    if (phdr->p_type == PT_LOAD) {
      uintptr_t dptr = align_dn(phdr->p_vaddr, phdr->p_align);
      uintptr_t uptr = align_up(phdr->p_vaddr + phdr->p_memsz, phdr->p_align);
      if (dptr < lp_min)
        lp_min = dptr;
      if (uptr > lp_max)
        lp_max = uptr;
      if (phdr->p_type == PT_INTERP)
        assert(!"ldso not supported!!!");
    }
  }
  int is_overlapped = 0;
  size_t prev_mend = 0;
  size_t prev_prot = 0;
  for (int i = 0; i < ehdr->e_phnum; i++) {
  // ... load and start

1
2
3
4
5
6
7
8   // ... open and do mmap
  // ... check elf header
  intptr_t lp_max = 0;
  intptr_t lp_min = -1;
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  // ... get bottom and top address of PT_LOADs

  // ... load and start

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15   // ... open and do mmap
  // ... check elf header
  intptr_t lp_max = 0;
  intptr_t lp_min = -1;
  void *phdrs = cast(Elf64_Phdr *, base + ehdr->e_phoff);
  // ... get bottom and top address of PT_LOADs

  void *virt = 0;
  uintptr_t lp_size = lp_max - lp_min;
  if (ehdr->e_type == ET_DYN) {
    virt = mmap(NULL, lp_size, PROT_NONE, MAP_ANON | MAP_PRIVATE, -1, 0);
    assert(virt != MAP_FAILED);
  }

  // ... load and start

将涉及到 elf 的 p_vaddr 的地址加上一个偏移就好了

c - void *start = cast(void *, ehdr->e_entry); + void *start = virt + ehdr->e_entry; printf("start is at %p\n", start);

c if (!(prev_prot & PROT_WRITE)) mprotect(cast(void *, orig_moff), overlapped, prev_prot | PROT_WRITE); lseek(fd, phdr->p_offset, SEEK_SET); - read(fd, cast(void *, phdr->p_vaddr), readsz); + read(fd, virt + phdr->p_vaddr, readsz); if ((prev_prot & prot) != prot || !(prev_prot & PROT_WRITE) && !(phdr->p_flags & PF_W)) mprotect(cast(void *, orig_moff), overlapped, prev_prot | prot);

c - void *exp = cast(void *, moff); + void *exp = virt + moff; printf(" map %#zx -> %p, sz = %#zx, msz = %#zx\n", foff, exp, fsize, msize);

简单的测试运行不必多说.

```makefile asm.out: ../asm.S $(CC) $< -o $@ -static -nostdlib -ffreestanding

+asm-pie.out: ../asm.S + $(CC) $< -o $@ -static-pie -nostdlib -ffreestanding + .PHONY:all ```

原来写死地址的做法就不行了, 得用 pie 的方式, 或者说写 pic (位置无关代码)

常用的是 rip 相对寻址

asm _start: movq $1, %rax movq $1, %rdi - movq $msg, %rsi + leaq msg(%rip), %rsi movq $len, %rdx syscall

txt $ elf-02/elf.out elf-02/asm-pie.out map 0 -> 0x7c272ed3e000, sz = 0x1000, msz = 0x1000 map 0x1000 -> 0x7c272ed3f000, sz = 0x1000, msz = 0x1000 map 0x2000 -> 0x7c272ed40000, sz = 0x1000, msz = 0x1000 map 0x2000 -> 0x7c272ed41000, sz = 0x2000, msz = 0x2000 start is at 0x7c272ed3f000 Hello world!

layout: center¶

后记¶

之前...

获得一个一个不常规的值, 但它却不是垃圾数据, 可以猜一下它是什么

$ ./a.out 282584257676671 987654321

shell $ python -c "import struct; print(struct.pack('<q', 282584257676671))" python b'\x7fELF\x02\x01\x01\x00'

这就是 elf 头部

elf generated from same-page.S

md {*|8,9} Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000001000 0x0000000000400000 0x0000000000400000 0x00000000000000a8 0x00000000000000a8 R E 0x1000 LOAD 0x0000000000002000 0x0000000000401000 0x0000000000401000 0x0000000000000008 0x0000000000000008 R 0x1000 LOAD 0x0000000000000800 0x0000000000401800 0x0000000000000800 0x0000000000000008 0x0000000000000008 R 0x1000

会把文件偏移量为 0 的页给加载上去, 而 linux kernel 在后面加载的页会覆盖前面的页

这样, 在虚拟地址原本是 int1 的位置, 反而读出了 magic number

zoom: 0.7¶

遍历所有的 PT_LOAD 的来更新 lp_max / lp_min 映射范围意义?

c if (phdr->p_type == PT_LOAD) { uintptr_t dptr = align_dn(phdr->p_vaddr, phdr->p_align); uintptr_t uptr = align_up(phdr->p_vaddr + phdr->p_memsz, phdr->p_align); if (dptr < lp_min) lp_min = dptr; // loadable program header minimal vaddr if (uptr > lp_max) lp_max = uptr; // loadable program header maximal vaddr if (phdr->p_type == PT_INTERP) assert(!"ldso not supported!!!"); }

可能没有意义

PT_LOAD - The array element specifies a loadable segment, described by p_filesz and p_memsz. The bytes from the file are mapped to the beginning of the memory segment. If the segment's memory size (p_memsz) is larger than the file size (p_filesz), the "extra'' bytes are defined to hold the value 0 and to follow the segment's initialized area. The file size may not be larger than the memory size. Loadable segment entries in the program header table appear in ascending order, sorted on the p_vaddr member.

这么写就变成了 防御性编程

为什么需要选取一个 base ?

不选也可以, 只是需要保证 PT_LOAD 间距符合 p_vaddr 的间距, 段之间的相对偏移必须与 p_vaddr 保持一致, 这一点我们在之前 EFI 文件关于 PIC 的位置讲过

关于 p_paddr

物理地址, 操作系统内基本不用

loader 可能会用

grub2
QEMU -kernel

关于 overlap?

有一些情况被 TIS ELF 特别指出了

Up to four file pages hold impure text or data depending on page size and file system block size. - The first text page contains the ELF header, the program header table, and other information. - The last text page holds a copy of the beginning of data. - The first data page has a copy of the end of text. - The last data page can contain file information not relevant to the running process.

The end of the data segment requires special handling for uninitialized data, which the system defines to begin with zero values. Thus if a file's last data page includes information not in the logical memory page, the extraneous data must be set to zero, not the unknown contents of the executable file.

Impurities in the other three pages are not logically part of the process image; whether the system expunges them is unspecified.

elf-02 overlap 与 dynamic

layout: center¶

overlap¶

zoom: 0.68¶

从一个不可控的方式说起¶

layout: center¶

dynamic¶

layout: center¶

后记¶

zoom: 0.7¶

layout: center¶

Thanks for watching!¶