在我的反汇编二进制文件(使用gcc -no-pie编译)文件中,我有以下内容:
00000000004017e0 <strstr@plt>:
4017e0: ff 25 32 0a 64 00 jmpq *0x640a32(%rip) # a42218 <_GLOBAL_OFFSET_TABLE_+0x218>
4017e6: 68 40 00 00 00 pushq $0x40
4017eb: e9 e0 fb ff ff jmpq 4013d0 <_init+0x20>
Disassembly of section .plt.got:
00000000004017f0 <.plt.got>:
4017f0: ff 25 d2 07 64 00 jmpq *0x6407d2(%rip) # a41fc8 <_DYNAMIC+0x1d0>
4017f6: 66 90 xchg %ax,%ax
4017f8: ff 25 da 07 64 00 jmpq *0x6407da(%rip) # a41fd8 <_DYNAMIC+0x1e0>
4017fe: 66 90 xchg %ax,%ax
后来我打来电话:
403ab7: e8 3c dd ff ff callq 4017f8 <strstr@plt+0x18>
有趣的精灵标题部分可能是:
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000000400040 0x0000000000400040
0x00000000000001f8 0x00000000000001f8 R E 8
INTERP 0x0000000000000238 0x0000000000400238 0x0000000000400238
0x000000000000001c 0x000000000000001c R 1
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
LOAD 0x0000000000000000 0x0000000000400000 0x0000000000400000
0x000000000041b68c 0x000000000041b68c R E 200000
LOAD 0x000000000041c3e8 0x0000000000a1c3e8 0x0000000000a1c3e8
0x0000000000027868 0x00000000000df0b8 RW 200000
DYNAMIC 0x0000000000441df8 0x0000000000a41df8 0x0000000000a41df8
0x00000000000001d0 0x00000000000001d0 RW 8
NOTE 0x0000000000000254 0x0000000000400254 0x0000000000400254
0x0000000000000044 0x0000000000000044 R 4
GNU_EH_FRAME 0x00000000003e2948 0x00000000007e2948 0x00000000007e2948
0x000000000000afd4 0x000000000000afd4 R 4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 10
GNU_RELRO 0x000000000041c3e8 0x0000000000a1c3e8 0x0000000000a1c3e8
0x0000000000025c18 0x0000000000025c18 R 1
和
Relocation section '.rela.plt' at offset 0xd98 contains 65 entries:
Offset Info Type Sym. Value Sym. Name + Addend
000000a42218 004300000007 R_X86_64_JUMP_SLO 0000000000000000 strstr@GLIBC_2.2.5 + 0
Relocation section '.rela.dyn' at offset 0xd08 contains 6 entries:
000000a41fd8 004a00000006 R_X86_64_GLOB_DAT 0000000000000000 strcmp@GLIBC_2.2.5 + 0
问题是该指令(callq 4017f8)在这里如何工作?这似乎是调用.plt.got,然后跳转到不在重定位表中的某个地方。谁能解释一下呢?