How does __libc_start_main @plt work?

To find out how the object file is loaded and run on Linux, I made the simplest code c, the file name is simple.c.

int main(){} 

Next, I create an object file and save the object file as a text file.

 $gcc ./simple.c $objdump -xD ./a.out > simple.text 

From many online articles, I could catch that gcc dynamically loads init functions like _start, _init, __libc_start_main @plt, etc. So I started reading the build code, helped by http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html .

Here is part of the build code.

 080482e0 < __libc_start_main@plt >: 80482e0: ff 25 10 a0 04 08 jmp *0x804a010 80482e6: 68 08 00 00 00 push $0x8 80482eb: e9 d0 ff ff ff jmp 80482c0 <_init+0x2c> Disassembly of section .text: 080482f0 <_start>: 80482f0: 31 ed xor %ebp,%ebp 80482f2: 5e pop %esi 80482f3: 89 e1 mov %esp,%ecx 80482f5: 83 e4 f0 and $0xfffffff0,%esp 80482f8: 50 push %eax 80482f9: 54 push %esp 80482fa: 52 push %edx 80482fb: 68 70 84 04 08 push $0x8048470 8048300: 68 00 84 04 08 push $0x8048400 8048305: 51 push %ecx 8048306: 56 push %esi 8048307: 68 ed 83 04 08 push $0x80483ed 804830c: e8 cf ff ff ff call 80482e0 < __libc_start_main@plt > 8048311: f4 hlt 8048312: 66 90 xchg %ax,%ax 8048314: 66 90 xchg %ax,%ax 8048316: 66 90 xchg %ax,%ax 8048318: 66 90 xchg %ax,%ax 804831a: 66 90 xchg %ax,%ax 804831c: 66 90 xchg %ax,%ax 804831e: 66 90 xchg %ax,%ax 080483ed <main>: 80483ed: 55 push %ebp 80483ee: 89 e5 mov %esp,%ebp 80483f0: b8 00 00 00 00 mov $0x0,%eax 80483f5: 5d pop %ebp 80483f6: c3 ret 80483f7: 66 90 xchg %ax,%ax 80483f9: 66 90 xchg %ax,%ax 80483fb: 66 90 xchg %ax,%ax 80483fd: 66 90 xchg %ax,%ax 80483ff: 90 nop ... Disassembly of section .got: 08049ffc <.got>: 8049ffc: 00 00 add %al,(%eax) ... Disassembly of section .got.plt: 0804a000 <_GLOBAL_OFFSET_TABLE_>: 804a000: 14 9f adc $0x9f,%al 804a002: 04 08 add $0x8,%al ... 804a00c: d6 (bad) 804a00d: 82 (bad) 804a00e: 04 08 add $0x8,%al 804a010: e6 82 out %al,$0x82 804a012: 04 08 add $0x8,%al 

My question is:

At 0x804830c, 0x80482e0 is called (I already accepted the previous instructions.).

At 0x80482e0, the process goes to 0x804a010.

At 0x804a010, the command is <out% al, $ 0x82>

... wait. only from? What was in% al and where is 0x82 ?? I am stuck on this line.

Please, help....

* ps I am starting to work with Linux and the operating system. I study the operating system concepts in a classroom, but still cannot find how to learn the appropriate Linux assembly language. I already downloaded the Intel processor manual, but it is too large to read. Can someone tell me good stuff for me? Thanks.

+5
source share
1 answer
 80482e0: ff 25 10 a0 04 08 jmp *0x804a010 

This means "get the 4-byte address stored in 0x804a010 and go to it."

 804a010: e6 82 out %al,$0x82 804a012: 04 08 add $0x8,%al 

These 4 bytes will be considered as address 0x80482e6, and not as instructions.

 80482e0: ff 25 10 a0 04 08 jmp *0x804a010 80482e6: 68 08 00 00 00 push $0x8 80482eb: e9 d0 ff ff ff jmp 80482c0 <_init+0x2c> 

So, we just completed the instruction, which moved us exactly one team ahead. At the moment, you are probably wondering if there is a good reason for this.

There is. This is a typical implementation of PLT / GOT. For more information, including a diagram, see Independent Code Position in Shared Libraries: Procedure Binding Table .

The actual code for __libc_start_main is in the glibc shared library. The compiler and time linker do not know where the code will be at runtime, so they put the __libc_start_main short function in your compiled program, which contains only three commands:

  • go to the location indicated by 4th (or 5th, depending on whether you want to count from 0 or 1) in GOT
  • push $ 8 onto the stack
  • go to recognizer procedure

The first time __libc_start_main call __libc_start_main recognizer code will run. It will find the actual location of __libc_start_main in the shared library and will correct the fourth GOT entry as that address. If your program calls __libc_start_main again, the jmp *0x804a010 will take the program directly to code in the shared library.

Can someone tell me good stuff for me?

x86 Assembly in Wikibooks can be started from one place.

+6
source

All Articles