Elf linking

Revision as of 13:30, 20 October 2011

Adventures in dynamic linking

Bab8yL qlxemglc wiqanrkf pwntokfj

iwjzllti oxxawzaa mdpcsagb

zuhkdnhb vvkefjyx gkkqoqpy

Linking

So first step in loading would be to identify all the loadable sections. The next step is to add all symbols of which the addresses are known from the file to the symbol table, such as any named addresses within the previously loaded sections.

After loading all the loadable sections and adding known symbols can do final relocation. This involves modifying the relocatable sections marked with RELOC.

Taking a look at the disassembly of the 'otherFunc' example can see (objdump -d):

• otherFunc starts at 0x00000026 in it's section within the file
• section .rodata + 0xd contains the string to print
• puts has no value set (just -4)

00000026 <otherFunc>:
  26:	55                   	push   %ebp
  27:	89 e5                	mov    %esp,%ebp
  29:	83 ec 08             	sub    $0x8,%esp
  2c:	c7 04 24 0d 00 00 00 	movl   $0xd,(%esp)
			2f: R_386_32	.rodata
  33:	e8 fc ff ff ff       	call   34 <otherFunc+0xe>
			34: R_386_PC32	puts
  38:	c9                   	leave  
  39:	c3                   	ret

What needs to now happen is the ram addresses of .rodata and puts functions need to be found and the values within otherFunc replaced with the proper ones. To assist in this is the relocation table section, found immediately following the section marked RELOC (not shown by objdump command?! but its there, trust me.. :P) Entries in this table define what address within the relocatable segment need external references, which symbol should be referenced and how the data should be modified.

Relocation records for .text section (objdump -r)

RELOCATION RECORDS FOR [.text]:
OFFSET   TYPE              VALUE 
00000010 R_386_32          .rodata
00000015 R_386_PC32        puts
0000002f R_386_32          .rodata
00000034 R_386_PC32        puts

For example lets say: .rodata section was loaded into address 0x8000 .text (program code) was loaded into 0x8100

The relocation entry for .text address 0x2f specifies that at that adress there is a 32 bit reference to what was in the .rodata section.(the text "Hai2u! \^_^\n"). Since we have loaded them previously .text is now at 0x8100 so 0x2f becomes 0x8100+0x2f, and .rodata is now at 0x8000. These name/value pairs are also added to the system serial table.

The linker needs to modify 0x812f to contain the proper address for .rodata (found by looking in the running system's symbol table since it was already added during a previous phase) which is 0x8000. But if you look the original value at that locaion is 0xd! This is because this value is intended to be added with whatever symbol value is requested, so finally... the proper address to write to 0x812f would be 0x8000+0xd or 0x800d :D

For the value of 'puts', first it looks up where puts is in the system's symbol table. Since the relocation entry specifies it is R_386_PC32 this means the value is to be program counter relative (PC + value == call address). So to figure out the proper value it takes the address value of the symbol puts (for sake of demonstration lets say its at 0x70f4) minus the address value of the instruction (0x8134) and finally add on whatever original value was in the location... so: 0x70f4 - 0x8134 + 0xfffffffc (0xfffffffc == -4), or symaddr - relocaddr + original value;

Now that function is loaded in ram and linked into all the other parts of the current system it needs. The otherFunc now can be called by looking up the symbol value address 'otherFunc' and casting it as a function:

typedef void(*_someFunc)(void);
...
((_someFunc)value)();

Makes perfect sense right! u_u;;;;

ARM Thumb insanity

Immediately one problem became clear, while it worked fine on x86 code, even after adding the required relocation handling code for R_ARM_CALL and R_ARM_ABS32 (this was same as x86 abs32 btw :D) the arm9 linking test wasn't working properly. After digging a bit realized that libnds operates mostly in 16 bit Thumb mode. For this mode R_ARM_THM_PC22 relocation handling was needed.

To get an idea how arm-eabi handles R_ARM_THM_PC22 i examined elf32-arm.h which contains the processor specific handling code and macros relating to relocation among other things. From this i immediately realized thumb being 16 bit uses two instructions for 'bl' each containing 11 bits representing the branch address and 5 bits for the branch high or branch low instrunctions. (0xf000 and 0xf800) Perfect sense right @_@)?

Below is the source code that was linked into thlink (see image):

#include <stdio.h>
//Just filler so that otherFunc is offset for better testing
int otherFunc(int argc, char **argv) {
        printf("otherFunc!\n");
}
 
int someFunc(void) {
        printf("Zomg! It Works! ^_^\n");
}

Modules

Great!! Now you've got it all loaded and ran it and now dunt need it no more, so now what?! If only there was some scheme to keep track of which object files are loaded and what needs to be done to unload them. Well, this is what modules are for, I will probably base mine on the structure of moduleLib. More on this later..