对图书馆的呼吁似乎具有误导性

时间:2017-09-22 14:30:29

标签: assembly elf

在我的反汇编二进制文件(使用gcc -no-pie编译)文件中,我有以下内容:

00000000004017e0 <strstr@plt>:
  4017e0:   ff 25 32 0a 64 00       jmpq   *0x640a32(%rip)        # a42218 <_GLOBAL_OFFSET_TABLE_+0x218>
  4017e6:   68 40 00 00 00          pushq  $0x40
  4017eb:   e9 e0 fb ff ff          jmpq   4013d0 <_init+0x20>

Disassembly of section .plt.got:

00000000004017f0 <.plt.got>:
  4017f0:   ff 25 d2 07 64 00       jmpq   *0x6407d2(%rip)        # a41fc8 <_DYNAMIC+0x1d0>
  4017f6:   66 90                   xchg   %ax,%ax
  4017f8:   ff 25 da 07 64 00       jmpq   *0x6407da(%rip)        # a41fd8 <_DYNAMIC+0x1e0>
  4017fe:   66 90                   xchg   %ax,%ax

后来我打来电话:

403ab7: e8 3c dd ff ff          callq  4017f8 <strstr@plt+0x18>

有趣的精灵标题部分可能是:

Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  PHDR           0x0000000000000040 0x0000000000400040 0x0000000000400040
                 0x00000000000001f8 0x00000000000001f8  R E    8
  INTERP         0x0000000000000238 0x0000000000400238 0x0000000000400238
                 0x000000000000001c 0x000000000000001c  R      1
      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
  LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000
                 0x000000000041b68c 0x000000000041b68c  R E    200000
  LOAD           0x000000000041c3e8 0x0000000000a1c3e8 0x0000000000a1c3e8
                 0x0000000000027868 0x00000000000df0b8  RW     200000
  DYNAMIC        0x0000000000441df8 0x0000000000a41df8 0x0000000000a41df8
                 0x00000000000001d0 0x00000000000001d0  RW     8
  NOTE           0x0000000000000254 0x0000000000400254 0x0000000000400254
                 0x0000000000000044 0x0000000000000044  R      4
  GNU_EH_FRAME   0x00000000003e2948 0x00000000007e2948 0x00000000007e2948
                 0x000000000000afd4 0x000000000000afd4  R      4
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     10
  GNU_RELRO      0x000000000041c3e8 0x0000000000a1c3e8 0x0000000000a1c3e8
                 0x0000000000025c18 0x0000000000025c18  R      1

Relocation section '.rela.plt' at offset 0xd98 contains 65 entries:
  Offset          Info           Type           Sym. Value    Sym. Name + Addend
000000a42218  004300000007 R_X86_64_JUMP_SLO 0000000000000000 strstr@GLIBC_2.2.5 + 0
Relocation section '.rela.dyn' at offset 0xd08 contains 6 entries:
000000a41fd8  004a00000006 R_X86_64_GLOB_DAT 0000000000000000 strcmp@GLIBC_2.2.5 + 0

问题是该指令(callq 4017f8)在这里如何工作?这似乎是调用.plt.got,然后跳转到不在重定位表中的某个地方。谁能解释一下呢?

0 个答案:

没有答案