diff options
Diffstat (limited to 'examples/manually_map_rtld.c')
| -rw-r--r-- | examples/manually_map_rtld.c | 45 |
1 files changed, 27 insertions, 18 deletions
diff --git a/examples/manually_map_rtld.c b/examples/manually_map_rtld.c index cfec1e6..0075ab8 100644 --- a/examples/manually_map_rtld.c +++ b/examples/manually_map_rtld.c @@ -20,7 +20,6 @@ You should have received a copy of the GNU General Public License along with Hypodermic. If not, see <http://www.gnu.org/licenses/>. */ - #include <sys/mman.h> #include <sys/stat.h> #include <sys/types.h> @@ -32,46 +31,56 @@ /* This is going to vary from distro to distro. */ #define LD_LINUX_PATH "/lib64/ld-2.25.so" +/* Copied from Linux fs/binfmt_elf.c */ +#define ELFEXEC_PAGESIZE 4096 /* TODO: Set this to the system pagesize. */ +#define ELF_MIN_ALIGN ELFEXEC_PAGESIZE + +#define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) +#define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) +#define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) + +/* Pre-computed. Mirrors total_mapping_size in fs/binfmt_elf.c */ +#define INIT_MAP_SIZE \ + ELF_PAGEALIGN(0x00223bc0 + 0x00001538 - ELF_PAGESTART(0x00000000)) + +#define AFTER_MAP_SIZE \ + ELF_PAGEALIGN(0x00000000000013b8 + ELF_PAGEOFFSET(0x0000000000001538)) +#define AFTER_MAP_OFF \ + ELF_PAGEALIGN(0x0000000000023bc0 - ELF_PAGEOFFSET(0x0000000000001538)) + int main(void) { int fd; char buf; - void *ld_text; - void *ld_rodata; - void *ld_data; + void *ld_initial; + void *ld_after; + void *ld_bss; if ((fd = open(LD_LINUX_PATH, O_RDONLY)) < 0) { fprintf(stderr, "Failed to open the runtime linker\n"); return 1; } - if ((ld_text = mmap(NULL, 0x23000, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)) == MAP_FAILED) { + if ((ld_initial = mmap(NULL, INIT_MAP_SIZE, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)) == MAP_FAILED) { fprintf(stderr, "Failed to map the runtime linker's .text\n"); return 1; } - if ((ld_rodata = mmap(ld_text + 0x223000, 0x1000, PROT_READ, MAP_PRIVATE, fd, 0x23000)) == MAP_FAILED) { - fprintf(stderr, "Failed to map the runtime linker's .rodata\n"); - return 1; - } - - if ((ld_data = mmap(ld_text + 0x224000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0x24000)) == MAP_FAILED) { - fprintf(stderr, "Failed to map the runtime linker .data\n"); + if ((ld_after = mmap((void *) ELF_PAGESTART((unsigned long) ld_initial + 0x0223bc0), AFTER_MAP_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, AFTER_MAP_OFF)) == MAP_FAILED) { + fprintf(stderr, "Failed to map the runtime linker's .data\n"); return 1; } printf("Mapping successful!\n"); printf("You can check procfs maps to see actual permissions.\n"); - printf("%s .text: %p\n", LD_LINUX_PATH, ld_text); - printf("%s .rodata: %p\n", LD_LINUX_PATH, ld_rodata); - printf("%s .data: %p\n", LD_LINUX_PATH, ld_data); + printf("%s .text: %p\n", LD_LINUX_PATH, ld_initial); + printf("%s .data: %p\n", LD_LINUX_PATH, ld_after); printf("Press any key to continue...\n"); read(0, &buf, 1); - munmap(ld_data, 0x23000); - munmap(ld_rodata, 0x1000); - munmap(ld_text, 0x1000); + munmap(ld_initial, INIT_MAP_SIZE); + munmap(ld_after, AFTER_MAP_SIZE); close(fd); return 0; |