How does the main function always load at the same address, while variables have a different address most of the time?

Question

I wrote this little program today, and I was shocked by the results. Here is the program

int main(int argc, char **argv) { int a; printf("\n\tMain is located at: %p and the variable a is located at address: %p",main,&a); return 0; } 

on my machine, the main function is always loaded at the address "0x80483d4", and the address of the variable continues to change. How does this happen? I read on operating systems that, as part of the virtualization scheme, the OS continues to move the address of the instructions. So why, every time I run this program, the main part is loaded at the same address?

Thanks in advance guys.

Answer 1

On ELF systems, such as Linux, the addresses where the segments of the loaded standard file files (ELF type ET_EXEC ) are ET_EXEC at compile time. General objects (type ELF ET_DYN ), such as libraries, are built regardless of position, and their segments are loaded anywhere in the address space (possibly with some restrictions on some architectures). You can create executable files in such a way that they are actually ET_DYN - they are known as "position-independent executables" (PIEs), but they are not a common technique.

What you see is the fact that your main() function is in the segment of the text segment of the compiled executable. Try also to print the address of a library function, such as printf() after finding it through dlsym() - if your system supports and enables randomization of address space allocation (ASLR), then you should see the address of this function, change it and run your program. (If you simply print the address of the library function by placing the link directly in your code, then in fact you can get the lookup table (PLT) springboard address, which is statically compiled to the fixed address in your executable file.)

The variable you see changes the address from run-to-run, because it is an automatic variable created on the stack, and not in statically allocated memory. Depending on the OS and version, the address of the stack base can go from start to run even without ASLR. If you move the variable declaration globally outside of your function, you will see that it behaves the same as your main() function.

Here is a complete example - compile with something like gcc -o example example.c -dl :

 #include <stdio.h> #include <dlfcn.h> int a = 0; int main(int argc, char **argv) { int b = 0; void *handle = dlopen(NULL, RTLD_LAZY); printf("&main: %p; &a: %p\n", &main, &a); printf("&printf: %p; &b: %p\n", dlsym(handle, "printf"), &b); return 0; } 

Answer 2

main(...) is the startup library code at startup time, in which the operating system boots and runs every time. Take a look at CRT (C Runtime Library), which will contain the code for this depending on your compiler.

Another thing to keep in mind is this address - I wouldn’t worry too much about it while C code is running. This is a random pattern, depending on a number of factors, such as OS loading, drivers used, hardware, AntiVirus software and etc.

In addition, in connection with the code, if you add static variables, functions, pointers, it is more important to change the layout of the binary code, and the addresses of the loaded characters at run time will be different.