More research into how the RTLD is loaded.

1 files changed, 27 insertions, 18 deletions

diff --git a/examples/manually_map_rtld.c b/examples/manually_map_rtld.c
index cfec1e6..0075ab8 100644
--- a/examples/manually_map_rtld.c
+++ b/examples/manually_map_rtld.c
@@ -20,7 +20,6 @@
    You should have received a copy of the GNU General Public License
    along with Hypodermic. If not, see <http://www.gnu.org/licenses/>. */
 
-
 #include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -32,46 +31,56 @@
 /* This is going to vary from distro to distro. */
 #define LD_LINUX_PATH "/lib64/ld-2.25.so"
 
+/* Copied from Linux fs/binfmt_elf.c */
+#define ELFEXEC_PAGESIZE 4096 /* TODO: Set this to the system pagesize. */
+#define ELF_MIN_ALIGN ELFEXEC_PAGESIZE
+
+#define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
+#define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
+#define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
+
+/* Pre-computed. Mirrors total_mapping_size in fs/binfmt_elf.c */
+#define INIT_MAP_SIZE \
+    ELF_PAGEALIGN(0x00223bc0 + 0x00001538 - ELF_PAGESTART(0x00000000))
+
+#define AFTER_MAP_SIZE \
+    ELF_PAGEALIGN(0x00000000000013b8 + ELF_PAGEOFFSET(0x0000000000001538))
+#define AFTER_MAP_OFF \
+    ELF_PAGEALIGN(0x0000000000023bc0 - ELF_PAGEOFFSET(0x0000000000001538))
+
 
 int main(void) {
     int   fd;
     char  buf;
-    void *ld_text;
-    void *ld_rodata;
-    void *ld_data;
+    void *ld_initial;
+    void *ld_after;
+    void *ld_bss;
 
     if ((fd = open(LD_LINUX_PATH, O_RDONLY)) < 0) {
         fprintf(stderr, "Failed to open the runtime linker\n");
         return 1;
     }
 
-    if ((ld_text = mmap(NULL, 0x23000, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)) == MAP_FAILED) {
+    if ((ld_initial = mmap(NULL, INIT_MAP_SIZE, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)) == MAP_FAILED) {
         fprintf(stderr, "Failed to map the runtime linker's .text\n");
         return 1;
     }
 
-    if ((ld_rodata = mmap(ld_text + 0x223000, 0x1000, PROT_READ, MAP_PRIVATE, fd, 0x23000)) == MAP_FAILED) {
-        fprintf(stderr, "Failed to map the runtime linker's .rodata\n");
-        return 1;
-    }
-
-    if ((ld_data = mmap(ld_text + 0x224000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0x24000)) == MAP_FAILED) {
-        fprintf(stderr, "Failed to map the runtime linker .data\n");
+    if ((ld_after = mmap((void *) ELF_PAGESTART((unsigned long) ld_initial + 0x0223bc0), AFTER_MAP_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, AFTER_MAP_OFF)) == MAP_FAILED) {
+        fprintf(stderr, "Failed to map the runtime linker's .data\n");
         return 1;
     }
 
     printf("Mapping successful!\n");
     printf("You can check procfs maps to see actual permissions.\n");
-    printf("%s .text:   %p\n", LD_LINUX_PATH, ld_text);
-    printf("%s .rodata: %p\n", LD_LINUX_PATH, ld_rodata);
-    printf("%s .data:   %p\n", LD_LINUX_PATH, ld_data);
+    printf("%s .text:   %p\n", LD_LINUX_PATH, ld_initial);
+    printf("%s .data:   %p\n", LD_LINUX_PATH, ld_after);
 
     printf("Press any key to continue...\n");
     read(0, &buf, 1);
 
-    munmap(ld_data, 0x23000);
-    munmap(ld_rodata, 0x1000);
-    munmap(ld_text, 0x1000);
+    munmap(ld_initial, INIT_MAP_SIZE);
+    munmap(ld_after, AFTER_MAP_SIZE);
     close(fd);
 
     return 0;