From 915e6fb7fcc9f7540b1123128eb7f8cf892c1288 Mon Sep 17 00:00:00 2001 From: jakob Date: Sat, 9 Sep 2017 13:55:58 -0400 Subject: More research into how the RTLD is loaded. --- examples/manually_map_rtld.c | 45 ++++++++++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 18 deletions(-) (limited to 'examples') diff --git a/examples/manually_map_rtld.c b/examples/manually_map_rtld.c index cfec1e6..0075ab8 100644 --- a/examples/manually_map_rtld.c +++ b/examples/manually_map_rtld.c @@ -20,7 +20,6 @@ You should have received a copy of the GNU General Public License along with Hypodermic. If not, see . */ - #include #include #include @@ -32,46 +31,56 @@ /* This is going to vary from distro to distro. */ #define LD_LINUX_PATH "/lib64/ld-2.25.so" +/* Copied from Linux fs/binfmt_elf.c */ +#define ELFEXEC_PAGESIZE 4096 /* TODO: Set this to the system pagesize. */ +#define ELF_MIN_ALIGN ELFEXEC_PAGESIZE + +#define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) +#define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) +#define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) + +/* Pre-computed. Mirrors total_mapping_size in fs/binfmt_elf.c */ +#define INIT_MAP_SIZE \ + ELF_PAGEALIGN(0x00223bc0 + 0x00001538 - ELF_PAGESTART(0x00000000)) + +#define AFTER_MAP_SIZE \ + ELF_PAGEALIGN(0x00000000000013b8 + ELF_PAGEOFFSET(0x0000000000001538)) +#define AFTER_MAP_OFF \ + ELF_PAGEALIGN(0x0000000000023bc0 - ELF_PAGEOFFSET(0x0000000000001538)) + int main(void) { int fd; char buf; - void *ld_text; - void *ld_rodata; - void *ld_data; + void *ld_initial; + void *ld_after; + void *ld_bss; if ((fd = open(LD_LINUX_PATH, O_RDONLY)) < 0) { fprintf(stderr, "Failed to open the runtime linker\n"); return 1; } - if ((ld_text = mmap(NULL, 0x23000, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)) == MAP_FAILED) { + if ((ld_initial = mmap(NULL, INIT_MAP_SIZE, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0)) == MAP_FAILED) { fprintf(stderr, "Failed to map the runtime linker's .text\n"); return 1; } - if ((ld_rodata = mmap(ld_text + 0x223000, 0x1000, PROT_READ, MAP_PRIVATE, fd, 0x23000)) == MAP_FAILED) { - fprintf(stderr, "Failed to map the runtime linker's .rodata\n"); - return 1; - } - - if ((ld_data = mmap(ld_text + 0x224000, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0x24000)) == MAP_FAILED) { - fprintf(stderr, "Failed to map the runtime linker .data\n"); + if ((ld_after = mmap((void *) ELF_PAGESTART((unsigned long) ld_initial + 0x0223bc0), AFTER_MAP_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, AFTER_MAP_OFF)) == MAP_FAILED) { + fprintf(stderr, "Failed to map the runtime linker's .data\n"); return 1; } printf("Mapping successful!\n"); printf("You can check procfs maps to see actual permissions.\n"); - printf("%s .text: %p\n", LD_LINUX_PATH, ld_text); - printf("%s .rodata: %p\n", LD_LINUX_PATH, ld_rodata); - printf("%s .data: %p\n", LD_LINUX_PATH, ld_data); + printf("%s .text: %p\n", LD_LINUX_PATH, ld_initial); + printf("%s .data: %p\n", LD_LINUX_PATH, ld_after); printf("Press any key to continue...\n"); read(0, &buf, 1); - munmap(ld_data, 0x23000); - munmap(ld_rodata, 0x1000); - munmap(ld_text, 0x1000); + munmap(ld_initial, INIT_MAP_SIZE); + munmap(ld_after, AFTER_MAP_SIZE); close(fd); return 0; -- cgit v1.3